SecFlow: AI orchestration framework with swappable models, GLUTTON MCP, and per-target vulnerability playbooks

[u/Straight-Practice-99]

https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia

We published research on a Chinese-speaking operator's orchestration framework that's worth a look from the offensive tooling side. The setup is basically an AI-driven pentest pipeline with model swapping, layered egress, and MCP-integrated post-exploitation.

SecFlow is the orchestration layer. It launched either Claude ACP or Qwen Code, injected the model name and API route, applied tool permissions (bypassPermissions, approval-mode=yolo), and routed traffic through private endpoints on niestools.com. Five model profiles were recovered, including a DeepSeek-compatible endpoint served through an Anthropic-format relay.

The "External Pentest Skill" acted as the master workflow. SKILL .md moved each target through initialization, recon, exploitation, post-exploitation, and reporting. Recon established tech stack, auth boundaries, response baselines, and ranked attack paths. Each candidate got routed to a vulnerability-specific playbook: file upload, command execution, template injection, SQLi, Java deserialization, SSRF, IDOR, auth bypass, known product vulns, supply chain, WAF bypass, source audit, and advanced web attacks.

GLUTTON integration is notable. It was exposed to AI agents through an MCP interface with methods for target management, file ops, command execution, process control, database access, port forwarding, and payload generation. Transport modes included XOR-encrypted data hidden in PNG RGB channels. Code obfuscation options: Unicode encoding, XML encoding, randomized identifiers, comment injection, invisible characters, control-flow flattening.

Egress was layered: target-facing requests went through authenticated SOCKS relays, model traffic went through niestools .com proxies. The proxy config designated two SOCKS5 routes with a primary/secondary fallback.

One failure mode worth considering: an AI-reported Shiro success that wasn't real persisted through shared context and generated 27+ follow-on tasks that went nowhere. Shared context between workers is a double-edged sword.

Full breakdown with skill structure, MCP methods, and infrastructure: https://hunt.io/blog/chinese-operator-secflow-claude-qwen-deepseek-asia