PentAGI is a self-hosted system of autonomous AI agents that carries out a penetration test from the first scan through to the written report. It is built for security researchers, red teams and consultants who already know how to drive nmap, Metasploit and sqlmap by hand, and who want an agent to do the grinding parts while they supervise. The project is written in Go with a React front end, is MIT licensed, and has gathered about 23,300 stars since it first appeared in January 2025.
What it does
The pitch is narrow and easy to check: you give PentAGI a target and a goal, and it plans the engagement, runs the tools, follows what it finds, and produces a report at the end.
Concretely, the system:
- splits an engagement into tasks and hands them to specialised agents rather than running one long prompt
- drives more than twenty security tools, including nmap, Metasploit and sqlmap
- executes everything inside Docker containers rather than on your own machine
- chains discovery into exploitation, so a flaw it finds is a flaw it then tries
- writes up the result with the exploitation steps included, not just a list of open ports
The name is an acronym the project spells out itself: Penetration testing Artificial General Intelligence. That is ambition, not a measured claim, and nothing in the repository benchmarks the agents against human testers. Treat the output as a first pass that a human reads, not as a signed-off assessment.
How it works
PentAGI is a multi-agent system with supervision. Instead of a single model looping over a shell, a team of agents divides the attack surface into tasks, and the README documents an agent supervision layer above them that keeps the work on track. That structure is the reason the run can last longer than a single model context and still stay coherent.
Isolation is the other design decision worth noting. The agents work in Docker, separated from your real systems, and the documentation has a section specifically about giving agents Docker access without handing over the host — the obvious risk when an autonomous process is allowed to launch containers and run exploitation tooling.
The rest of the stack is conventional server software. A GraphQL API exposes the system to other programs, so PentAGI can sit inside a pipeline rather than only being clicked through in a browser. Several instances can run side by side, keyed by a tenant ID, which is what a consultancy running separate client engagements would need.
Model choice is left open. The repository documents provider configuration for OpenAI, Anthropic, Google Gemini, AWS Bedrock, DeepSeek, GLM, Kimi, Qwen and MiniMax, plus Ollama for models you host yourself. That last option matters in this domain: engagement data is sensitive, and running the reasoning locally keeps target details off a third-party API. There is also a Langfuse integration for observability, so you can inspect what the agents actually decided rather than only reading their conclusions.
Getting started
This is a self-hosted deployment, not a signup. You bring a Docker host, pull the stack, configure at least one LLM provider with your own key, and log in to the web interface; the README walks through quick start, provider configuration and the post-login workflow in that order. Budget for the model bill separately — an autonomous agent that plans, retries and reports will spend a lot of tokens on a single engagement.
The MIT license means you can run it commercially and modify it without negotiating terms. The repository has been pushed to recently, so this is live code rather than an abandoned demo.
When to use it / when not
Use it when you have written authorisation to attack the target and want breadth quickly: a lab, a CTF, your own staging environment, an internal network you are paid to test. The report-with-steps output is the genuinely useful part, because writing up findings is the slow tail of most engagements.
Do not use it as a substitute for scoped, authorised testing. Pointing an autonomous exploitation system at infrastructure you do not own is a crime in most jurisdictions, and an agent that chains discovery into exploitation by design can cause real damage to a production system before anyone reads its output. Do not use it as compliance evidence either; nothing here replaces the judgement a human tester signs their name to. And if your policy forbids sending network details to an external model, plan on the Ollama path from the start rather than retrofitting it.
PentAGI deserves attention from anyone running offensive security work who is curious how far agent automation has actually come, and from defenders who want to understand what an attacker with this tooling can do cheaply. It is a serious engineering effort rather than a prompt wrapper — sandboxing, supervision, multi-tenancy and observability are all in the box. The honest framing is that it compresses the routine hours of an engagement, not that it replaces the tester, and it should be pointed only at systems you are explicitly permitted to break.