New Kali Linux Tools for 2026: AI and Cloud Attack Testing

Kali’s newest tools track where the attack surface actually moved

The new Kali Linux tools 2026 has actually shipped tell you a lot about where penetration testing has moved this year: Kali Linux 2026.1 and 2026.2 between them added 26 new tools to the official repository, heavily weighted toward AI-integrated applications and cloud infrastructure, alongside the usual steady stream of web-app tooling. If your mental model of “new Kali tools” is still Wi-Fi and web app scanners, it’s worth a proper look at what’s landed recently.

AI and LLM security testing

• garak – an LLM vulnerability scanner that probes a model or application for known failure modes: jailbreaks, data leakage, hallucination-driven security issues, and more, in a structured, repeatable way rather than ad-hoc prompt poking.
• llm-fuzz – an automated fuzzer purpose-built for LLM APIs, throwing malformed and adversarial inputs at an endpoint to surface crashes, unexpected behaviour, or filter bypasses.
• promptmap – maps prompt injection vulnerabilities specifically, which matters given prompt injection is flagged as one of the fastest-growing vulnerability classes in 2026 for any app built on chatbots, RAG pipelines or agent frameworks.

Together these three cover the practical LLM-testing workflow: garak for broad model-level probing, promptmap for the specific injection class everyone’s worried about, and llm-fuzz for the raw input-fuzzing layer underneath both.

Cloud attack simulation

• cloudbrute – multi-cloud asset discovery, useful for the reconnaissance phase before you know exactly what’s actually exposed across AWS/Azure/GCP.
• pacu – an AWS exploitation framework that automates common post-compromise actions once you have some initial AWS access, rather than scripting each step by hand.
• stratus-red-team – runs realistic, granular cloud attack techniques (think MITRE ATT&CK for cloud) so defenders can validate detection coverage against specific known attack patterns.
• enumerate-iam – focused specifically on AWS IAM privilege enumeration, a step that’s often the actual crux of a cloud engagement since IAM misconfiguration is one of the most common real-world cloud findings.

Other 2026.1/2026.2 additions worth knowing

• Metasploit MCP – AI-assisted exploitation via the Model Context Protocol, tying into the broader trend of natural-language-driven pentesting workflows.
• Adaptix C2 – a red team command-and-control framework.
• XSSStrike – WAF-bypassing XSS scanning.
• SSTImap – server-side template injection discovery.
• WP Probe – WordPress plugin enumeration.
• Atomic Operator – runs MITRE ATT&CK-mapped detection validation tests.
• GEF – enhanced GDB support for binary analysis work.

Getting them if you’re not on a fresh install

sudo apt update && sudo apt full-upgrade -y
sudo apt install pacu stratus-red-team enumerate-iam garak promptmap

Not every tool in this list ships in every metapackage by default – some are under kali-tools-cloud or need installing individually depending on your Kali variant. Check apt search <toolname> if a package name above doesn’t resolve directly on your system.

Why this matters even if you’re not doing cloud engagements yet

APIs and cloud infrastructure are called out specifically as the primary attack surface for SaaS and fintech companies in 2026, and continuous security testing embedded in CI/CD is moving from optional to expected rather than a point-in-time audit exercise. The cloud tooling in this list – pacu, stratus-red-team, enumerate-iam, cloudbrute – is a reasonable signal of where client engagements are actually heading if you do pentest work professionally, even if your current caseload is still mostly web app and network testing. Worth getting comfortable with at least the AWS-focused tools before a cloud-heavy engagement lands on your desk unexpectedly.