What Is CyberForge? A Modular Cybersecurity LLM Agent Framework

CyberForge is an open-source project (created August 2026, Python) that treats security operations as a set of composable LLM-driven agents and tasks. Instead of a monolithic commercial platform, it gives you building blocks: a BaseAgent class that defines a role (SOC Analyst, Detection Engineer, Purple Team Specialist) and a BaseTask class that defines a unit of work. You wire them together through a centralized Scenario CLI.

The core idea is modularity. Rather than locking you into one vendor’s model or one workflow, CyberForge lets you assemble the exact agent pipeline your team needs and run it against your own lab infrastructure. That design philosophy matters because the cybersecurity agentic AI market is exploding — projected to grow from USD 2.43 billion in 2026 to USD 9.63 billion by 2031, a 31.71% CAGR according to Mordor Intelligence. Teams are looking for flexible, low-cost ways to experiment before committing to expensive platforms.

Key Features: Scenario CLI, Multi-Provider LLM Support, and Lab Mock Mode

CyberForge’s most distinctive feature is its centralized Scenario CLI. You drive everything from a single entry point:

python main.py list
python main.py run hello_agents
python main.py run log_analysis
python main.py run purple_team

The list command shows available scenarios, and run executes them. This is a deliberate contrast to sprawling, configuration-heavy security AI platforms — the whole framework is navigable from one command.

Multi-Provider LLM Support

CyberForge is provider-agnostic. It supports Google Gemini, NVIDIA NIM, OpenCode/OpenRouter, OpenAI, Anthropic, and local Ollama. That breadth is a real advantage for SOC teams that want to avoid vendor lock-in, compare model quality on the same task, or run entirely on-premises with a self-hosted model.

Lab Mock Mode

The standout feature for budget-conscious researchers is Lab Mock Mode. When no API key is set, CyberForge falls back to a deterministic, offline mock that simulates agent responses. This lets you validate your scenario wiring, test the CLI, and prototype workflows without spending a cent on cloud LLM calls. For a lab tool, that is a genuinely thoughtful touch — you can build and test the entire pipeline before you ever provision an API key.

Hands-On: Running hello_agents, log_analysis, and purple_team Scenarios

The three flagship scenarios give a good sense of the framework’s range.

hello_agents is the smoke test. It spins up the configured agents, confirms the provider connector works, and verifies that tasks can be dispatched and completed. If you are testing a new provider or a fresh install, this is where you start.

log_analysis is the detection-engineering workhorse. It points an agent at log data and asks it to identify suspicious activity, correlate events, and surface findings. This maps directly to the LLM-assisted defense category that is the largest research area in the field — 130 papers (17.2%) in the Awesome-LLM4Cybersecurity survey.

purple_team is where CyberForge shines. It coordinates both offensive and defensive agents — an adversary-emulation agent generates attack behavior while a detection agent tries to catch it. This is the classic purple team loop, automated. It aligns with the fastest-growing research area: LLM-assisted attack, at 110 papers (14.6%) and climbing.

Architecture Deep Dive: BaseAgent, BaseTask, Workflow, and LLM Provider Connector

CyberForge’s architecture is deliberately small and decoupled. The two primitives are:

• BaseAgent — defines a role with a system prompt, a provider binding, and a set of capabilities. You subclass it to create a SOC Analyst, Detection Engineer, or Purple Team Specialist.
• BaseTask — defines a unit of work: an input, an expected output shape, and the agent that should handle it.

A Workflow orchestrates tasks across agents, and an LLM Provider Connector abstracts the API differences between Gemini, OpenAI, Anthropic, NIM, and Ollama. Because the connector is a single interface, swapping providers is a configuration change rather than a code rewrite.

This decoupling is the framework’s main architectural strength. It follows the same pattern that made agentic frameworks popular in other domains: separate the “what” (task) from the “who” (agent) from the “how” (provider). For security teams, that separation means you can reuse the same detection task against a cheap local model in development and a frontier model in production.

Lab Server Helpers and Jupyter Notebook VM Integration

CyberForge is built for lab environments, and it shows. It ships built-in lab server helpers — an HTTP server and a mock FTP server — so you can stand up realistic target infrastructure without standing up a full production environment. That is ideal for adversary emulation and detection testing where you need a controlled, disposable target.

It also integrates with Jupyter notebooks for VM research. You can drive agents from a notebook, inspect intermediate outputs, and iterate on prompts and tasks interactively. For researchers who live in notebooks, this lowers the barrier to entry considerably.

CyberForge vs. Commercial Security AI Platforms

The tradeoff is clear. Commercial platforms win on production hardening, compliance, and support. CyberForge wins on cost, flexibility, and the ability to run fully offline. For a lab or a small team that wants to learn and prototype, the open-source route is increasingly viable — a point reinforced by the growing ecosystem of open-source LLM security tooling.

The Bigger Picture: Agentic AI in Cybersecurity (Market Stats & Trends)

CyberForge is not an island — it sits at the center of a major industry shift. The numbers are striking:

• The cybersecurity agentic AI market is projected to grow from USD 2.43 billion (2026) to USD 9.63 billion by 2031, a 31.71% CAGR (Mordor Intelligence).
• 94% of respondents identified AI as the key driver of cybersecurity change for the year ahead (World Economic Forum).
• 77% of organizations already deploy AI for phishing detection, intrusion response, and SOC automation (WEF).
• North America holds the largest market share; Asia-Pacific is the fastest-growing region at 32.71% CAGR.
• SMEs are projected to grow at a 32.11% CAGR — directly favoring low-cost, open-source frameworks like CyberForge.

The research landscape confirms the agentic shift. The Agent4Cybersecurity category is emerging in the Awesome-LLM4Cybersecurity survey, with 63 papers (8.3%) of 756+ total. LLM-assisted attack is the hottest growing area (110 papers, 14.6%), while LLM-assisted defense is the largest (130 papers, 17.2%). Frameworks like CyberForge are the practical embodiment of this research trend — turning papers into runnable agent pipelines.

Safety, Responsible Use, and the Lab-Only Disclaimer

Any security tool that automates adversary emulation carries responsibility. CyberForge is explicitly designed for lab environments, VM research, and authorized testing. The responsible-use framing is not optional — it is the difference between a research tool and a liability.

If you use CyberForge, follow these guardrails:

• Run it only against infrastructure you own or have explicit authorization to test.
• Keep it in isolated VMs or containers, never against production systems.
• Treat generated attack behavior as a research artifact, not a playbook for real engagements.
• Review and validate all agent outputs before acting on them.
• Understand your local laws and your organization’s rules of engagement.

The lab-only disclaimer is a feature, not a limitation. It keeps the framework safe to distribute and safe to learn with.

Who Should Use CyberForge (and Who Shouldn’t)

Use CyberForge if you are:

• A security researcher or student learning purple teaming and detection engineering.
• A SOC team prototyping agent workflows before committing to a commercial platform.
• A small or mid-size organization (SME) that wants low-cost, self-hosted AI security tooling.
• A detection engineer who wants to experiment with Sigma rule generation and log analysis agents.
• Anyone who wants to test multiple LLM providers on the same security task.

Skip CyberForge if you are:

• A large enterprise needing production-grade, compliance-ready, vendor-supported security AI.
• A team that needs a fully managed SaaS solution with an SLA.
• Someone looking for a turnkey product rather than a framework to assemble.

Verdict: Strengths, Limitations, and 2026 Outlook

Strengths:

• Genuinely modular architecture with clean BaseAgent/BaseTask separation.
• Provider-agnostic with six or more LLM backends and a deterministic offline mock.
• Zero-cost prototyping via Lab Mock Mode.
• Built-in lab servers and Jupyter integration for realistic, disposable testing.
• Aligns with the fastest-growing segment of the cybersecurity AI market.

Limitations:

• Early-stage project (created August 2026, minimal community traction).
• Lab-focused; you must harden it yourself for production.
• No vendor support or SLA.
• Documentation and examples are still maturing.

2026 Outlook: CyberForge arrives at exactly the right moment. With the agentic AI security market growing at 31.71% CAGR and SMEs driving demand for low-cost tooling, a modular, open-source, provider-agnostic framework fills a real gap. It is not a replacement for enterprise platforms, but for researchers, purple teams, and budget-conscious SOCs, it is a compelling way to get hands-on with LLM-driven security operations today.

FAQ

What is CyberForge? CyberForge is an open-source, Python-based modular cybersecurity LLM agent framework for lab environments, VM research, adversary emulation, detection engineering, and purple team automation. It composes reusable agents and tasks through a centralized Scenario CLI.

Which LLM providers does CyberForge support? It supports Google Gemini, NVIDIA NIM, OpenCode/OpenRouter, OpenAI, Anthropic, and local Ollama — six or more backends — plus a deterministic offline Lab Mock Mode that runs without any API key.

What is Lab Mock Mode in CyberForge? Lab Mock Mode is a deterministic, offline fallback that simulates agent responses when no API key is set. It lets you prototype and test scenario workflows with zero cloud LLM spend.

Is CyberForge safe to use? Yes, when used responsibly. It is explicitly designed for lab environments and authorized testing only. You should run it only against infrastructure you own or are authorized to test, and always validate agent outputs.

How does CyberForge compare to commercial security AI platforms? CyberForge is free, open source, self-hosted, and provider-agnostic, making it ideal for research and prototyping. Commercial platforms offer production hardening, compliance, and vendor support, but at higher cost and with less flexibility.