A new version of Metasploit, called Metasploit 6.5, has introduced an important feature that allows AI assistants to interact directly with the Metasploit penetration-testing framework.
This development could make security testing much faster and easier. However, it also creates new security risks because attackers could potentially use AI to find vulnerabilities and launch attacks with less manual effort.
What is Metasploit?
Metasploit is a well-known security testing framework. It was created in 2003 by security researcher H.D. Moore and is now managed by Rapid7. Security professionals use Metasploit to test computers, servers and networks for security weaknesses. It contains thousands of modules that can be used to test known vulnerabilities.
For example, if a company is running an old version of software with a known security weakness, a penetration tester can use Metasploit to check whether that weakness can actually be exploited. This makes Metasploit useful for ethical hackers and security teams. However, the same capabilities can also be misused by attackers.
What has changed in Metasploit 6.5?
The major change in version 6.5 is the addition of an MCP (Model Context Protocol) server.
In simple terms, MCP allows an AI assistant to communicate with another application and use its functions.
Metasploit 6.5 exposes 16 tools that an AI assistant can use. These tools can help with tasks such as:
- Searching for available exploits
- Finding information about discovered computers and services
- Retrieving stored credentials
- Monitoring active jobs and sessions
- Managing information collected during security testing
This means that instead of manually performing every step, a security professional could potentially ask an AI assistant to help with several stages of a penetration test.
Four particularly powerful functions are disabled by default because they can directly execute Metasploit modules or interact with active sessions. This provides an additional safety barrier.
Why is AI + Metasploit important?
Normally, a penetration tester needs to understand the target, search for the correct vulnerability, select an exploit, configure it and then run it.
An AI assistant can potentially help automate much of this process.
For example, an AI could identify the software version running on a server, search Metasploit for a matching vulnerability and recommend the appropriate testing module.
The biggest concern is what happens when this capability is used by attackers.
An AI system that can identify vulnerabilities and a tool like Metasploit that can test or exploit them could significantly reduce the time required to launch an attack.
The AI provides the reasoning and decision-making, while Metasploit provides the technical execution.
Why should security teams care?
This development does not mean that AI can automatically break into every computer. Systems still need vulnerabilities, misconfigurations or other weaknesses for an attack to succeed.
However, AI could make attacks faster, more scalable and easier for less skilled attackers.
There is also a concern about combining AI vulnerability discovery with automated exploitation. If an AI discovers a new weakness and can immediately use a tool like Metasploit to test it, attackers may have less time to respond.
This is why organizations should focus on keeping systems patched, reducing unnecessary services, monitoring suspicious activity and controlling access to security tools.
Metasploit remains an extremely useful tool for legitimate security testing. The challenge is that, when combined with AI, the same technology can potentially accelerate both defensive security testing and offensive cyberattacks.
Cyber Security Researcher. Information security specialist, currently working as risk infrastructure specialist & investigator. He is a cyber-security researcher with over 25 years of experience. He has served with the Intelligence Agency as a Senior Intelligence Officer. He has also worked with Google and Citrix in development of cyber security solutions. He has aided the government and many federal agencies in thwarting many cyber crimes. He has been writing for us in his free time since last 5 years.
