Raptor: Transforming Claude Code into an Offensive & Defensive Security AI Agent

Raptor Project Overview: An AI-Driven Offensive & Defensive Security Agent

Raptor is an open-source project that transforms Anthropic's Claude Code into a general-purpose AI offensive and defensive security agent. By configuring Claude.md files, creating rule systems, sub-agents, and skill modules, and orchestrating the use of security tools, Raptor turns a large language model into a security research and adversarial operations platform with adversarial thinking capabilities.

Since its launch, the project has quickly taken the security community by storm, amassing over 2,500 stars and nearly 400 forks on GitHub. It's developed in Python.

Core Design Philosophy: From Code Assistant to Security Agent

Redirecting AI Capabilities to Cybersecurity

Claude Code is Anthropic's AI programming assistant, excelling at code generation, debugging, and project management. Specifically, Claude Code is a command-line AI programming tool launched by Anthropic in 2025 that runs directly in the terminal, understands the entire codebase context, and performs operations like file editing, running commands, and searching code. Unlike traditional IDE plugins, Claude Code operates in agent mode with the ability to autonomously plan and execute multi-step tasks. The Claude.md file serves as Claude Code's system-level configuration file—similar to a project's "constitution"—defining the AI's behavioral guidelines, knowledge boundaries, and tool usage permissions within a specific project.

The brilliance of Raptor lies in the fact that it doesn't build a security tool from scratch. Instead, it "redirects" existing powerful AI capabilities to the cybersecurity domain through carefully designed prompt engineering and configuration systems. Prompt Engineering refers to the technical methodology of guiding large language models to produce specific behaviors through structured instructions and contextual information. It has evolved from simple Q&A optimization to an engineering practice encompassing system prompts, role definitions, chain-of-thought guidance, and more. Raptor leverages the Claude.md mechanism precisely this way—reshaping the AI's "persona" from a programming assistant to a security researcher through meticulously crafted configuration files.

The advantages of this approach are clear: developers don't need to train a specialized security model. By simply defining the agent's behavioral boundaries, thinking patterns, and tool invocation rules through the Claude.md configuration file, general-purpose AI can acquire professional security analysis capabilities.

Multi-Layer Agent Architecture: Rules, Sub-Agents, and Skills

Raptor's architecture reflects the typical layered approach of modern AI Agents. An AI Agent is an AI system capable of perceiving its environment, making autonomous decisions, and taking actions to achieve goals. Unlike traditional single-turn Q&A AI, Agents possess memory, planning, tool usage, and self-reflection capabilities. The core idea behind Raptor's Multi-Agent System is to decompose complex tasks among multiple specialized Agents working collaboratively, each with independent role definitions and capability boundaries. This architecture draws on microservice design principles—individual Agents maintain single responsibilities while an orchestration layer handles coordination.

Specifically, Raptor's layered architecture includes:

• Rules Layer: Defines the agent's fundamental behavioral guidelines and security constraints, ensuring all operations remain within compliance boundaries
• Sub-Agents Layer: Decomposes complex security tasks into multiple specialized sub-agents, each responsible for analysis or operations in a specific domain. In the security context, this means there can be a reconnaissance Agent dedicated to information gathering, an attack Agent for vulnerability exploitation, a post-exploitation Agent for privilege escalation, and so on—each fulfilling its role while collaborating with others, simulating the complete workflow of a real attack chain
• Skills Layer: Encapsulates concrete security operational capabilities, including vulnerability scanning, traffic analysis, penetration testing techniques, and more
• Tool Orchestration Layer: Coordinates the invocation sequence and data flow across various security tools, enabling automated offensive and defensive workflows

This layered design allows Raptor to maintain architectural clarity while providing sufficient extensibility.

Dual Offensive & Defensive Capabilities: Red Team and Blue Team Scenarios Explained

The concepts of Red Team and Blue Team originated from military exercises and were later adopted in cybersecurity. The Red Team simulates real attackers, using the same techniques, tactics, and procedures as hackers (i.e., the TTPs—Tactics, Techniques, and Procedures—defined in the MITRE ATT&CK framework) to launch simulated attacks against target organizations. The Blue Team is responsible for detecting, responding to, and defending against these attacks. In recent years, the Purple Team concept has also emerged, emphasizing collaboration and knowledge sharing between red and blue teams.

It's worth noting that traditional penetration testing is highly dependent on human experience. Developing a senior penetration testing engineer typically requires 3-5 years, and the global cybersecurity talent gap exceeds 4 million (according to ISC² statistics). The involvement of AI Agents could partially alleviate this talent shortage.

Offensive Security: Red Team Penetration Testing

In red team exercises and penetration testing scenarios, Raptor assists security researchers in adversarial thinking. By configuring an adversarial thinking mode, the agent can adopt an attacker's perspective to systematically discover weak points in target systems. This not only significantly improves testing efficiency but also lowers the barrier of dependency on senior security talent—by automating standardized testing workflows, human experts can focus on designing advanced attack paths that require creative thinking.

Defensive Security: Blue Team Threat Detection

In blue team defense scenarios, Raptor can assist with threat analysis, log auditing, anomaly detection, and more. The AI agent can rapidly process massive volumes of security data, identify potential attack patterns, and provide specific response recommendations.

Traditional cybersecurity defense relies primarily on two types of technology: signature-based detection (e.g., antivirus software matching known malicious code signatures) and rule-based detection (e.g., firewalls and Intrusion Detection Systems filtering traffic through predefined rules). These methods are effective against known threats but often fall short when facing zero-day vulnerabilities, Advanced Persistent Threats (APTs), and novel attack techniques. While SIEM (Security Information and Event Management) systems can aggregate multi-source log data, their alert rules still require manual creation and maintenance, and they face severe alert fatigue—enterprise security teams may receive thousands of alerts daily, many of which are false positives. The advantage of AI security agents lies in their ability to understand the semantic context of attacks, correlate seemingly unrelated security events, and identify complex attack patterns that traditional rule engines struggle to capture.

Security Research and Vulnerability Analysis

Beyond practical offensive and defensive operations, Raptor is also suited for security research scenarios—analyzing novel vulnerabilities, studying the evolution of attack techniques, evaluating the effectiveness of defense strategies, and providing security researchers with an efficient analysis platform.

Technical Significance and Industry Impact

A Paradigm Shift for AI Agents in Security

Raptor represents an important trend: specializing general-purpose AI capabilities through Agent frameworks. Compared to traditional security tools, AI security agents possess stronger contextual understanding and flexible reasoning abilities, enabling them to handle unstructured security problems—something that rule engines and signature detection cannot easily achieve.

Enthusiastic Response from the Open-Source Community

The project's rapid accumulation of 2,500+ stars clearly reflects the security community's strong demand for AI-empowered security work. The open-source model also means the community can continuously contribute new rules, skills, and sub-agents, constantly expanding the platform's capability boundaries.

Potential Risks and Ethical Considerations

Any offensive and defensive security tool is a double-edged sword. Raptor lowers the technical barrier for security operations, which benefits defenders in rapidly enhancing their capabilities but also carries the risk of abuse by malicious actors.

The dual-use nature of offensive security tools has long been a point of industry controversy. Historically, well-known penetration testing frameworks like Metasploit and Cobalt Strike have been abused by malicious actors for real attacks. AI makes this issue even more complex: it lowers the barrier to using attack techniques, enabling individuals without deep technical backgrounds to potentially launch sophisticated attacks. From a legal perspective, unauthorized penetration testing is illegal in most jurisdictions, with regulations such as the Computer Fraud and Abuse Act (CFAA) in the United States and the Network and Information Security Directive (NIS2) in the EU providing clear guidelines.

The project's rules layer provides behavioral constraints to a certain extent. Responsible security tool developers typically build in usage restrictions and audit logs, and Raptor's rules layer design embodies this philosophy. However, the ethical self-discipline and legal compliance of users remain an indispensable bottom line. Additionally, since 2024, multiple governments have begun paying attention to AI's application in cyberattacks, and relevant regulatory frameworks are being accelerated.

Conclusion: AI Agents Reshaping How Cybersecurity Works

Raptor demonstrates a viable path for transforming large language models into specialized security agents. It doesn't simply have AI "write security code"—instead, through systematic Agent architecture design, it endows AI with adversarial thinking and security operational capabilities. As AI Agent technology continues to mature, projects like Raptor will likely fundamentally change how the cybersecurity industry operates—freeing security teams from tedious repetitive work so they can focus their energy on more strategically valuable decisions.

Key Takeaways

• Raptor transforms Claude Code into an offensive and defensive security agent through Claude.md configuration and a multi-layer architecture (rules, sub-agents, skills, tool orchestration)
• The project supports three major scenarios: offensive security (red team penetration testing), defensive security (blue team threat analysis), and security research
• It adopts a general-purpose AI specialization approach, obtaining security analysis capabilities without training a dedicated model
• The project has earned 2,500+ GitHub stars and nearly 400 forks, reflecting the security community's strong demand for AI empowerment
• While lowering the barrier to security operations, it also introduces potential abuse risks, making ethical and compliance issues worthy of attention