Cain: AI pentest agent spans six cloud providers

Cain is an open-source agent built on the Claude Agent SDK that runs authorized penetration tests across six cloud platforms using 46 strictly read-only tools. The repository, published by cdxiaodong, positions the agent against real engagements rather than practice labs: the stated targets are business-logic flaws, authentication chains and cloud misconfigurations.

The read-only promise is enforced in code

The 46 tools are grouped into recon, scan, verify, post and report. Each carries its own blacklist of dangerous flags, and the project states that write, exploit and persistence operations — POST, PUT, DELETE, aws rm/mv/cp and similar — are rejected before execution. Scope is not a line in a prompt: the target is written into scope.yaml, and a PreToolUse hook blocks any tool call whose target falls outside it. That moves the boundary decision from the model to the configuration file.

Discovery and validation never share context

Findings are produced in one agent session and judged in a separate one, with no shared context, so a result cannot confirm itself. Verdicts come back as structured output with four states. The pipeline is fixed — recon, then test, then report — and state is kept in workspace files, so an interrupted run can resume. Credentials are redacted before anything is written to disk.

Why the Chinese clouds matter here

Coverage spans AWS, Azure, GCP, Alibaba Cloud, Tencent Cloud and Huawei Cloud, and the project treats the last three as its distinguishing feature: most offensive tooling stops at the big three. A dedicated module builds a privilege-escalation graph for IAM and RAM, mapping identities to escalation actions to targets, exports it as DOT or JSON, and walks it with breadth-first search. Claude is the default backend; the pi bridge routes to OpenAI, Gemini, DeepSeek, OpenRouter or an Anthropic-compatible gateway, and recon and test phases can use different providers and models.

The benchmark is self-reported

Reports in the repository, dated August 26, 2026 and August 31, 2026, score the agent against the vulnerable-terraform test set:

That is three cases and eight expected findings in total, measured by the project against templates it selected — not a comparison with competing scanners and not a third-party assessment.

What could not be checked

The repository was the only readable source for this report: there is no independent coverage and no external audit. So it remains unverified whether the read-only guards hold up in production environments, how much the finder-validator split actually cuts false positives, and how the agent performs outside its own test templates. Star, fork and commit counts are a snapshot from the moment of reading and keep moving. The project is explicit about the one condition that is not technical: use it on your own systems, or under written authorization.