AI penetration tester & builder

Aaron
Moorcroft

CyberZombi3 · AI Penetration Tester & Pentest Tool Builder

I break into systems for a living, and part of that work is testing with frontier AI, including non-public models. Separately, when the off-the-shelf tools aren't enough, I build my own: a command-and-control framework, AI agents that plan and run their own enumeration, a home SOC lab to see attacks from the other side, a free email spoofing check anyone can run against their own domain, and, just to see if it could be done, an operating system vibe coded from scratch with AI.

16projects and counting
17klines of AI-built assembly in CyberOS
124local tools driven by APT Pro's agent
3games, two of them for iPhone

Featured work

Things I'm proudest of

Offensive tooling, systems written from nothing, and a couple of things built purely for fun.

All projects →
NightJARC2 operator console with a live beacon session
Command & control

NightJARC2

A C2 framework built from scratch for lab work: beacons, listeners, SOCKS5 pivoting and payload staging. Every operator action attributed and logged, evasion opt-in and always recorded.

Python C2 Lab use only
View details →
The Bounty map screen with a route through hijacked devices
iOS game

The Bounty: Contract Hacker

A freelance hacking sim for iPhone. Take bounties from rival factions, route through hijacked devices and wipe your tracks before the threat hunt finds you.

JavaScript Capacitor iOS
View details →
CyberOS desktop with Files and Settings windows open
Operating system

CyberOS

A 32-bit OS from scratch in NASM: bootloader, windowed desktop, FAT32 and a TCP/IP stack.

NASM x86
View details →
AI pentest agent dashboard showing its planning loop
AI agent

AI Pentest Agent

An autonomous recon engine that plans, runs and iterates on enumeration with an LLM-driven loop.

Python FastAPI
View details →
Ember Linux desktop with KDE Plasma
Linux distribution

Ember

My own Debian-based Linux: one machine instead of three. A Windows-feeling KDE desktop, iCloud mail and calendars, a real security toolset, and a snapshot around every package change.

Debian live-build KDE Plasma
View details →

What I work on

Offensive security

Pentesting by day, and the C2, recon and harness tooling to back it up.

Systems from scratch

An OS in assembly and a Linux build of my own, to understand the layers underneath.

AI agents

Agents that plan and run their own work, with scope and a human kept in charge.

Games & apps

Phone and browser games, with the toughest testers in the house aged three and six.

Interested?

Drop me a message.

Drop me a message →

Latest from the blog

2026-10-21Same game, new decade 2026-08-18Anyone can send email as your business 2026-08-14What actually fits on a laptop