The idea behind it is simple to state and harder to build correctly: AI can genuinely help an operator move faster during an engagement, but it should never get a direct, unsupervised path to sensitive actions like execution on a target system. Erebus is structured so the AI layer reads engagement state, proposes work, and queues tasks, while the human operator holds the actual approval decision at every step.
Erebus is intended for authorized security testing, internal labs, and research environments with explicit permission. It is not a shortcut around scope, rules of engagement, or operator judgment.
The short version
A C2 framework lets an operator manage controlled sessions, assign tasks, collect output, and keep track of activity during an approved engagement. Erebus keeps that core shape, then adds an AI-aware control loop and review gates so automation is structured instead of bolted onto the side. The architecture breaks down into four layers. The teamserver tracks listeners, active sessions, task queues, authentication, and the full event history, functioning as the source of truth for the entire engagement. The implant is the piece that runs on in-scope systems, executing approved tasks and returning output. The operator CLI is where the human stays in the loop, reviewing what is happening, approving or denying actions, and redirecting the plan as new information comes in. The AI layer sits alongside all of this, reading state and preparing next-step tasks, but it never bypasses the approval gates that route everything through the operator first.
| Layer | Job |
|---|---|
| Teamserver | Tracks listeners, sessions, task queues, auth, and event history. |
| Implant | Runs approved tasks and returns output from in-scope systems. |
| Operator CLI | Keeps the human in the loop for review, approval, and direction changes. |
| AI layer | Reads state and prepares next-step tasks without bypassing approval gates. |
Why AI-native matters
In a lot of security tools, "AI" means a chat box bolted onto the side that explains output after the fact, summarizing a scan result or interpreting a log line once the real work is already done. That is a genuinely different thing from what Erebus is built around. Erebus structures its state, from the very beginning, so that AI can actually reason over it: sessions, task results, errors, pending approvals, and past operator decisions all have a consistent shape the agent can work with.
That distinction matters because AI assistance is only actually useful in this context when two conditions hold. First, the AI has to be able to see the real, current engagement context, not a summary or a snapshot from an hour ago. Second, it has to be constrained by exactly the same rules that govern the human workflow, with no separate, faster path around the approval process. The agent's job is to suggest. The operator's job is to decide. Erebus is built to keep that division clean rather than letting it blur under time pressure.
Who should care
Erebus is most relevant to three groups: teams actively exploring what AI-assisted C2 looks like in practice rather than in a vendor pitch, smaller red team and pentest groups that want tooling they can actually audit instead of trusting on reputation alone, and researchers who would rather read source code than take a black-box control plane's claims at face value.
If your team's most pressing problem right now is getting client-ready reports out the door faster, Zypheron Desktop is the more directly relevant product to start with today. If your question is closer to "where is AI-native C2 actually headed, and can I trust it," Erebus is the source tree worth watching and, eventually, running in a controlled lab.
Why open source
C2 software deserves verification. Erebus is public so operators can inspect the teamserver, the implant path, the task queue, and the approval model before they run anything in a lab. C2 software touches sensitive systems and sensitive trust, which means it deserves to be verified rather than taken on faith, and Erebus is public specifically so operators can inspect all of it themselves before they run any of it against a real target, even a lab one.