Layer 1
Identity
An adversarial reasoning engine that generates and tests hypotheses. It does not blindly execute — it runs the scientific method against a target.
Adversarial Reasoning · Runs Offline
The offensive-security agent
that runs on your machine.
ARIA is a local, offline, uncensored REPL that drives real penetration testing. It observes, hypothesizes, tests through a sandboxed shell, learns, and reports — with a confidence score and an evidence trail on every step. Nothing leaves your machine.
aria session · 127.0.0.1:9999 · sandboxed
$ aria session --target 127.0.0.1:9999 \
--scope 127.0.0.1:9999 --auto-approve-high
{"action":"bash", "confidence":0.9}
curl …/sqli?id=1' OR '1'='1
→ admin · Gordon · Pablo · Bob · Hack
{"action":"bash" /vulnerabilities/exec}
ip=127.0.0.1;id
→ uid=33(www-data) gid=33(www-data)
{"action":"report", "confidence":0.95}
✓ SQLi + RCE + XSS confirmed
ReconFingerprintingVulnerability ScanningSQL InjectionCommand InjectionReflected XSSPrivilege EscalationExploit ChainsPost-ExploitationEvidence Reporting
ReconFingerprintingVulnerability ScanningSQL InjectionCommand InjectionReflected XSSPrivilege EscalationExploit ChainsPost-ExploitationEvidence Reporting
The core idea
Not a chatbot with a shell.
A reasoning engine that runs the scientific method.
ARIA observes a target, forms ranked hypotheses about how it breaks, tests them through a sandbox, learns from the result, and reports with evidence. The research bet: an offensive-security agent is only trustworthy when its reasoning is typed, scored, scoped, and auditable — so that is the contract it is built on.
Layer 2
Reasoning protocol
Every step is typed JSON: observation, hypotheses, confidence scores, evidence trail, next action, unknowns, scope check, priority. Reasoning is a contract, not prose.
Layer 3
Hard constraints
Scope is enforced. Confirmation bias is refused. Uncertainty is stated, never hidden. Every finding ships with a remediation.
Principles
- Every hypothesis carries a confidence score and an evidence trail.
- It declares uncertainty — and never fabricates confidence.
- A human approves every action. Autonomy is earned, not assumed.
- All data stays local. Auditability over speed.
- Scope-gated, not censorship-gated — it answers offensive questions directly, bounded only by the authorized scope.
Four ways to run it
Talk to it, or turn it loose
ARIA is one engine behind four surfaces — from a fully conversational REPL where you drive, to a scoped loop and a deterministic pipeline that run on their own. All of them clear the same authorization gate.
aria chatConversational REPLYou direct in plain language; the model reasons, calls tools on demand, links evidence across turns, and stops when you say done. The Claude-Code-style mode.
aria sessionScoped autonomous loopThe decision engine emits one typed action at a time — bash · load_skill · invoke_agent · report — inside the sandbox, until it reports or the governor halts.
aria scan7-agent pipelineA deterministic pipeline — Planner → Recon → Scanner → VulnAnalysis → Exploitation → PostExploit → Reporter — checkpointed and resumable.
aria tabletopPre-engagement scopingA five-question interview — crown jewels, worst case, out-of-scope, exploit depth, fragile services — that produces an engagement plan configuring scope, scan profile, and exploit depth.
And when a finding is worth reporting: aria disclose drives a 90-day responsible-disclosure pipeline — vendor-contact discovery, a CVE-style report, and a tracked draft → sent → acknowledged → patched lifecycle.
How it works
The engine reasons; the agents report back
The decision engine calls specialist agents — recon, scanner, exploitation, reporter — and folds each result back into its next move. Every hand-off clears a control: an authorization gate, human approval before anything risky, false-positive pruning, the governor, the ledger.
Loop governor · Audit ledger — every exchange watched · recorded
Live — request out, result back, one agent at a time
— the same loop, step by step —
01
Observe
ARIA fingerprints the target and enumerates services, tech, and entry points — building the picture before it forms a single hypothesis.
Authorization gate — scope, proof, and target whitelist are validated first. A missing field is a hard stop; nothing runs out of scope.
02
Hypothesize
It ranks candidate attack vectors and attaches a confidence score and an evidence trail to each — an explicit theory of the target, not a guess.
Confidence floor — the governor halts if the model loses the thread, so a low-confidence spiral never becomes wasted action.
03
Test
The decision engine emits one typed action and executes it through a sandboxed shell — recon runs freely, real exploitation proceeds step by step.
Sandbox + human approval — commands run as the unprivileged aria-runner behind an allowlist; anything high-risk halts for your sign-off.
04
Learn
Results feed back into the next decision. On a win, ARIA distills the working command chain into a new, staged skill for you to promote.
Append-only ledger — every decision, command, and result is recorded and cannot be edited after the fact.
05
Report
It emits an evidence-backed report: each finding with the exact request, the response evidence, a confidence score, and a remediation.
Loop governor — seven halts bound the whole run so it can never spin, wander, or run away.
The engine
Model-agnostic by design
Nothing about the model is hardcoded — point ARIA at whatever local model you trust. Instead of routing tasks to different models, it loads the right skill into context per phase, and it all runs on hardware you own.
Runs today
Any local model
on the laptop you have
point the engine at the model you trust
Scales up
Same loop, bigger model
on a workstation, 64 GB+
more headroom — the decision engine is unchanged
Model-agnostic, local by default
The decision engine is pluggable — point ARIA at whatever local model you trust; nothing is hardcoded. It runs entirely on your machine: no cloud, no external APIs, no telemetry. And rather than hot-swapping models per task, it loads the right SKILL.md into context per phase — skill-context replaces model-swapping.
Typed-JSON decision engine
The model emits one typed action at a time — bash · load_skill · invoke_agent · report — each with a confidence score, a rationale, and an evidence trail. Structured and auditable, never free-form prose.
Local 3-tier knowledge base
A local ChromaDB RAG store grounds every decision: (1) structured facts — NVD/CVE, CWE, OWASP, Exploit-DB; (2) reasoning examples — CTF write-ups and bug-bounty reports; (3) personal research memory — past findings and a false-positive log.
spec sheet
- Runtime
- Local · offline · air-gappable
- Model
- Pluggable · local, your choice
- Orchestration
- Model-driven session loop (REPL)
- Actions
- bash · load_skill · invoke_agent · report
- Skills
- 82 loadable · dynamic per-phase context
- Knowledge
- ChromaDB · 3-tier RAG
- Audit
- Append-only per-session ledger
Capabilities
What it actually does
Not a prompt library — a working operator. Recon to report, offensive at the core, everything sandboxed and evidence-backed.
Autonomous recon
Fingerprints the target, enumerates services and entry points, and ranks candidate attack vectors — each with a confidence score and an evidence trail.
Multi-tool scanning
Drives Nuclei and WhatWeb through the sandbox as single loop actions — real scanner orchestration, allowlisted and audited, no glue scripts.
Authenticated exploitation
Chains real exploitation end to end — SQL injection, command injection, reflected XSS — behind the authorization gate, with human approval on every risky step.
Self-learning skills
An 82-skill catalog the model loads per phase, plus new skills ARIA writes from its own successful sessions — staged, and promoted only when you say so.
Evidence-backed reports
Every finding carries the exact request, the response evidence, a confidence score, and a remediation — written to an append-only per-session ledger.
12 security domains
Loads skills across detection, response, cloud, appsec, identity, red-team, web, pentest and more — offensive at the core, defensive on demand.
Skills
One model, sharpened by 82 skills
ARIA augments the model with SKILL.md files loaded dynamically per phase — so instead of hot-swapping models, it swaps in the right expertise. And when a session wins, it writes a new one.
DetectionResponseCloud & InfraAppSec / DevSecOpsIdentity & AccessRed TeamWeb App SecurityPentestSystem SecurityGovernanceRisk & CompliancePlatform / AI82 skills · 12 domains
Skill lifecycle
Load
the right SKILL.md into context, per phase
Use
the model reasons with that expertise
Learn
a winning session is distilled into a new skill
Promote
you approve it before it goes live
Learned skills are staged — captured automatically, but never active until you promote them.
Proof
Not a demo reel — a verified result
ARIA has run the full loop against a live target, sandboxed, and its findings matched a ground truth checked independently, out of band.
Proven against DVWA
An end-to-end, fully-sandboxed session confirmed three vulnerability classes on a live target — SQL injection (full user-table dump), command injection (RCE, uid=33(www-data)), and reflected XSS — each matching a ground truth verified independently, out of band.
Sandboxed & audited
Every command executed as the unprivileged aria-runner user under a binary allowlist. Every decision, command, and result is written to an append-only, per-session audit ledger — the record cannot be edited after the fact.
Local & offline
ARIA runs entirely on your machine — no cloud, no external APIs, no telemetry. Findings are age-encrypted at rest. What it reasons about stays where you ran it.
Roadmap
Shipped, in progress, and what’s next
The loop and the skills layer are built and proven. The near term folds the rest of the pipeline into the loop; the horizon is defense, disclosure, and a much larger local model.
ShippedShipped
The agentic loop
- Observe → Hypothesize → Test → Learn → Report
- Sandboxed aria-runner execution + authorization gate
- 7-halt loop governor + append-only audit ledger
- Proven end-to-end against a live DVWA target
ShippedShipped
Skills & self-learning
- 82-skill catalog surfaced to the decision engine
- Self-learning — synthesize a skill from a successful session
- Operator-gated promotion: staged → active
- Recon & scanner invocable as loop capabilities
- Responsible-disclosure scaffolding — 90-day tracker
In progressIn progress
Autonomy & reasoning
- Fold analyst, vuln-analysis, exploitation & reporter into the loop
- Cross-domain attack-chain reasoning
- Assumption-violation detector
- Public benchmark runner — DVWA, Juice Shop, WebGoat, Metasploitable, HTB
In progressIn progress
Memory
- Cross-session RAG Tier-3 research memory
- Observation distillation for long tool output
- Auto-compaction under context pressure
- A knowledge-graph memory tier
PlannedPlanned
Skills & defense
- MITRE ATT&CK, GTFOBins & PayloadsAllTheThings packs
- Blue-team → purple-team skills
- Self-learning reuse feedback & refinement
PlannedPlanned
Scoped skill adapters
- Scoped skill-agents — Planner, Web, Network, System, DB, Cloud
- Each with its own adapter on one shared base
- Routed per target class — still model-agnostic
PlannedPlanned
Disclosure & reach
- Automated vendor-contact discovery + CVE-style reports
- Patch monitoring & researcher-credit tracking
- MCP integrations
- Remote-runner backend + multi-session coordination for teams
- An API for solo researchers + a shared anonymized false-positive DB
PlannedPlanned
Hardening
- Per-command nsjail / firejail sandbox
- Signed Merkle-chain audit ledger
Local · Offline · Uncensored
Observe. Hypothesize.
Test. Learn.
A research project in autonomous offensive security — a governed, auditable agent that runs entirely on your own machine. No cloud, no telemetry, nothing to sign up for.