Teaching AI to Hack CICS: Hack3270, MCP, and Source-Assisted Pentesting

Michelle and David have spent years breaking CICS applications the old-fashioned way, manually hunting hidden fields, bypassing presentation-layer controls, and injecting wordlists and AIDs through TN3270 streams. This talk is about what happens when you hand those tools to AI.

CICS applications were built assuming the 3270 terminal was a trusted, dumb device. Security was often “enforced” by hiding fields or marking them read-only at the screen layer – security through obscurity baked into decades-old design. Hack3270 was built to expose exactly that. Now, by integrating Hack3270 with Model Context Protocol (MCP), AI models have the ability to drive that tooling directly, enumerating transactions, toggling field protections, injecting payloads, and reasoning about responses in ways that would take a human tester hours to work through manually.

We’ll walk through the architecture of the integration: how MCP lets an AI model interact with live TN3270 sessions, what prompting strategies work, and where the AI surprises you. We’ll also cover source-assisted pentesting, what that looks like and what changes when you give the model access to CICS program definitions, transaction maps, or application source, and how that context dramatically sharpens what it can find.

Live demos will use the Damn Vulnerable CICS Application (DVCA) to illustrate the full workflow, from unauthenticated enumeration to transaction-level exploitation. Whether you are a CICS developer, a mainframe security professional, or just AI-curious, you’ll leave with a new perspective on what automated mainframe testing looks like in 2026