GitOps practices and Infrastructure as Code tooling have quietly created one of the most underguarded attack surfaces in modern security: the IaC repository. Terraform configs, CDK synthesis output, Helm values, and pipeline definitions collectively reconstruct your full environment topology — no live access, no state queries required.

Marauders Map as Code (MMaC) is an offensive tool that operationalizes this insight. From repository access alone, MMaC uses an LLM agentic layer to reconstruct infrastructure topology, map service dependencies and IAM relationships, and score attack paths by blast radius. It then applies published Theory of Mind research (arXiv corpus) to Agile artifact and ceremony data — sprint backlogs, PR velocity, retro outputs, commit patterns — to identify which contributors and processes are most exploitable, and precisely when.

The result is targeted, timed attacks delivered through the pipeline automation surface rather than direct infrastructure — because pipelines survive redeploys, span environments, and leave no anomalous network signatures. When MMaC determines direct infrastructure compromise is the higher-value path, it selects it automatically. Payloads are marshaled and persisted through legitimate workflow scheduling engines: Jira automations, ServiceNow workflows, Kubernetes CronJobs, and CI/CD pipeline schedules themselves — surviving incident response and cleanup operations that look for traditional IOCs.

This talk demonstrates the MMaC architecture, the contributor intelligence layer, the pipeline-first attack philosophy, and the evasion characteristics of scheduling-hook persistence. Demo runs live against a Proxmox-managed lab environment. Defensive implications and detection opportunities are covered.