One-line description (for a project card)
An adaptive WPA2-handshake auditing agent whose real subject is safe agentic automation: the authorization boundary is enforced as an invariant of the tool layer rather than an instruction the model is asked to honor.
Abstract
GUNGNIR is a self-hosted, loop-engineered agent that automates the WPA2 handshake capture-and-crack chain. The wireless attack itself is a solved, twenty-year-old problem, and it is not the point. GUNGNIR uses that well-understood task as a testbed for a harder question: how an autonomous offensive agent can be made both effective and bounded at the same time.
The system wraps a brittle, single-pass attack script in verifiers, explicit stop rules, and a formal error taxonomy. Where a linear script reports one undifferentiated failure whenever any step misses, GUNGNIR recognizes which of several distinct failure states it has actually hit, an empty capture, an incomplete four-way handshake, or a valid handshake the wordlist did not cover, and routes each to its correct recovery. That is the loop engineering: turning a script that spins on repeated failure into an agent that reasons about why it failed.
What it demonstrates
The transferable result is a control pattern for agentic systems. GUNGNIR’s authorization boundary is enforced in code: a target absent from the allowlist is refused before a single frame is transmitted, which makes the constraint an invariant of the execution layer rather than a request in a system prompt. A boundary implemented this way is immune to prompt injection and to model error, because there is no natural-language surface to attack and no code path to the transmission that does not pass the check first.
The wider claim, and the one that carries into my consulting and product work, is that offensive automation and safe automation are the same engineering problem. The discipline that makes the agent effective, verifiers, stop rules, and a bounded tool surface, is the same discipline that makes it safe. GUNGNIR is the concrete instance of the control pattern that underlies my work on agentic AI vendor risk and self-hosted AI governance.
How it works
A chat command triggers the agent. Before anything else, the target is checked against the allowlist and refused if it is not present. Downstream, a verification loop inspects each capture and returns a structured reason, so the agent can tell an empty capture from a partial handshake from a wordlist miss, and respond accordingly: widen the capture window, force a fresh handshake with a targeted deauthentication and recapture, or escalate the cracking strategy from dictionary to mask to rules. WPA3 and protected management frames are treated as a hard stop, out of scope by design, which is also the real-world mitigation for the entire attack class.
Scope and safety
Every run is conducted against an access point I own, on an isolated, airgapped subnet, with authorization enforced by allowlist. No production or third-party network is ever in scope, and out-of-scope targets are refused by construction rather than by policy. The offensive capability exists only to make the safety architecture demonstrable.
Stack
Self-hosted end to end on a bare-metal homelab fleet: a Qwen-class model served through vLLM behind a LiteLLM gateway, a chat-based trigger, and a physically isolated wireless range built on hostapd and commodity radios. The design goal throughout was an agent that runs entirely on infrastructure I control, with every guardrail living in the tooling.