In the wild
Villager: Chinese-published AI-native pentest framework on PyPI, 10,000+ downloads, dual-use concerns
AIR-2025-0131 AIR record · 2025-09-straiker-villager-pentest-framework
From the supporting source
10,030 downloads across multiple operating systemsstraiker.ai
The record
Disclosed
2025-09-11
Occurred
2025-07-23
Vendor
Cyberspike / Changchun Anshanyuan Technology
Product
Villager (Cyberspike) integrating DeepSeek v3 with Kali tooling
Risk domain
Governance › Policy drift
System type
Generative model
Who acted
Human acted on output (contested) — a published offensive agent framework; no campaign observed using it
Attack surface
Agent framework
Autonomy level
Semi-autonomous
Initial vector
Public pypi distribution of offensive agent framework
Impact type
Offensive capability proliferation
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI01 – Agent Goal Hijack
- MITRE ATLAS
- AML.T0010 – AI Supply Chain Compromise
- NIST AI RMF
- GOVERN 1.5
- EU AI Act
- —
- ISO/IEC
- TR 24028; 23894
- AIUC-1
- E. Accountability
- Scope
- agent failure
- Mitigation
- Implement version pinning for models and prompts; Monitor for behavioral drift.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
10,030 PyPI downloads in roughly two months
Capability abused
Taxonomy & references
Curator notes
impact_realized deliberately false: Straiker documents no campaign using Villager, and the 'next Cobalt Strike' framing is an analogy about future risk. Download counts on PyPI include mirrors, CI and researchers, so they are a poor proxy for adoption. Straiker is a security vendor. Included as the reference case for offensive-agent-framework proliferation, and because GTIG later observed APT31 prompting Gemini with a 'trialling out the hexstrike MCP tooling' persona, showing the category does get used.
Supporting sources
Cite as
Enkrypt AI. "Villager: Chinese-published AI-native pentest framework on PyPI, 10,000+ downloads, dual-use concerns". AIR, AIR-2025-0131. https://agentincident.vercel.app/i/AIR-2025-0131/ (accessed 2026-10-19).