PentAGI: The Open-Source Autonomous Pentest Agent Trending on GitHub

PentAGI, an open-source system from the security engineering company VXControl, is the fastest-rising AI security repo on GitHub this week: the trending list shows about 1,800 new stars in a day, and the repository page shows roughly 28,600 stars and 4,300 forks in total under an MIT license. In its own words, it is a "fully autonomous AI Agents system capable of performing complex penetration testing tasks." You describe a target and a goal, a team of AI agents plans the work, runs professional tools such as nmap, Metasploit and sqlmap inside a Docker sandbox, and hands back a report.

This post explains what the PentAGI repository actually contains, how it is built, how it compares with other agent-security coverage on explainx.ai, and the rules that should govern anyone who runs it. We read the project's README directly; we did not run it against any target for this post, so nothing here is a benchmark of how well it finds vulnerabilities.

PentAGI at a glance

What does PentAGI actually do?

The README describes a flow with a hierarchy: a Flow contains Tasks, Tasks contain SubTasks, and SubTasks are carried out by agents typed as researcher, developer or executor. An orchestrator hands out the work. The researcher analyzes the target and searches earlier cases, the developer plans an attack path, and the executor runs commands in a container. Every command, result and artifact is stored in PostgreSQL with the pgvector extension, so later flows can retrieve what worked before.

Key components named in the README:

• Sandboxed tool execution. Operations run in isolated Docker containers, with automatic image selection per task.
• Memory. Long-term storage of research and successful approaches, plus an optional Neo4j knowledge graph (via Graphiti) that tracks hosts, services and findings.
• Web intelligence and search. A built-in scraper browser and integrations with search systems such as Tavily, Firecrawl, Perplexity, DuckDuckGo, Google Custom Search, Sploitus and SearXNG.
• Observability. Langfuse for LLM traces and Grafana, Prometheus and related tooling for system monitoring.
• APIs. REST and GraphQL with bearer-token authentication, so you can script it.
• Reporting. Web view, Markdown and PDF export. The README says JSON export is not a documented output today.

Execution monitoring: how it handles agents that loop

Autonomous agents get stuck. PentAGI ships an optional, Beta execution monitor: when the same tool call repeats past a threshold (default 5) or total tool calls pass a threshold (default 10), a mentor agent is invoked to analyze progress, detect loops, and suggest another approach or a search for established solutions. It is off by default (EXECUTION_MONITOR_ENABLED) and the thresholds are configurable. The README says execution monitoring and task planning mainly help smaller models, which matters if you run a local model for cost or privacy.

Which model should you run it on?

PentAGI is model-agnostic, which is both a feature and a risk. The README includes a production guide for a local vLLM deployment with Qwen3.5-27B-FP8, and sections for Ollama, OpenAI, Anthropic, Gemini, Bedrock, DeepSeek, GLM, Kimi, Qwen, MiniMax, Mistral and xAI. Two practical points:

1. Hosted models may refuse. Providers apply safety policies to offensive-security requests. Anthropic runs a cyber verification program with tiers for vetted defenders, and our threat intelligence report coverage shows how labs monitor misuse. Expect friction, and read each provider's usage policy before you route pentest traffic through it.
2. Data leaves your network. Prompts include target details and tool output. Self-hosting the model is the only way to keep an engagement fully in-house.

How is this different from other AI security tools?

PentAGI sits at the offensive end of a spectrum we have covered from several angles. Armadin's AI attack swarms are a commercial product with Mandiant founder Kevin Mandia behind it. Anthropic's free scanner for open-source maintainers is defensive: it finds bugs in code you own. PentAGI is a self-hosted framework you point at running systems, which makes authorization the central question.

Why the legal and safety questions come first

An agent that can chain nmap discovery into Metasploit and sqlmap runs is capable of real damage when misaimed, and agents do sometimes wander. Our coverage of Gemini agents that breached three companies and the felony benchmark on AI agent legal liability shows what happens when an agent acts beyond its brief. If you want to see how those incidents are tracked, our running tracker is at /felony-bench.

Practical rules if you try PentAGI:

• Get written scope first. Only targets you own or are contracted to test, with IP ranges and exclusions spelled out.
• Isolate it. Run on a dedicated host or VM. The README has a section on giving agents Docker access without giving away the host, which you should read before mounting the Docker socket.
• Block egress you do not intend. Limit the sandbox network to the scoped targets so a confused agent cannot reach anything else.
• Keep a human in the loop. Review commands in the web UI and Langfuse traces, especially exploit steps.
• Protect the API. The REST and GraphQL interface can launch attacks. Do not expose it publicly.

For teams running their own agents, AgentBeam, the agent security platform from the explainx.ai team, is built to stop AI agents before they take dangerous actions, a useful complement to scoping and sandboxing.

What are people asking about PentAGI?

Does it need Kubernetes? No. The README's path is Docker Compose through an interactive installer for Linux, macOS and Windows. Expect a fairly heavy stack, since the optional pieces add Neo4j, ClickHouse, Langfuse, Grafana and more.

Can it run fully offline? The model can be local through Ollama or vLLM, but the search integrations call external APIs unless you disable them or use a self-hosted SearXNG.

What does it not do? The README states it is not a CALDERA-style breach-and-attack-simulation product with predefined campaigns. Agent-authored BAS-style scripts are described as future or conceptual work.

Can I trust the results? The README reports only the project's own tests with a local Qwen3.5-27B-FP8 model (a 2-3x increase in time and tokens for a claimed 2x quality gain from execution monitoring) and no independent vulnerability-finding benchmark, so treat every finding as a lead to be verified by a human, not as proof.

A safe first evaluation plan

If you decide to test it, a measured approach tells you more than a flashy demo. Here is a plan we would follow.

1. Build a range. Stand up one or two deliberately vulnerable machines on an isolated virtual network with no route to the internet or your office LAN. Snapshot them so you can reset after every run.
2. Pick a small goal. Ask for something narrow, such as enumerating services and reporting outdated versions, before you ask for exploitation. Narrow goals make it obvious when an agent drifts.
3. Compare models. Run the same goal with a hosted frontier model and a local open model. The README suggests execution monitoring helps smaller models, so test it on and off and record the number of tool calls, wall-clock time and token cost per run.
4. Log everything. Keep Langfuse traces and the stored command history. Count findings that were real, findings that were false positives, and findings a human tester would have found in the same time.
5. Review the report. Judge whether the generated Markdown or PDF would be usable by a client: does it include evidence, reproduction steps and sensible severity?
6. Write down the failure modes. Loops, refusals, hallucinated vulnerabilities and commands that exceeded scope are the data that decide whether this fits your workflow.

A crooked hook catching a blank instruction card, illustrating prompt injection against an autonomous pentest agent

One more risk deserves a mention: because PentAGI feeds scraped web pages and tool output back into an LLM, a hostile target can plant text designed to steer the agent. This is a prompt-injection problem. A target that returns crafted banners or pages could try to make the agent run unintended commands, which is another reason to restrict the sandbox network and to keep a human reviewing high-impact steps.

Should you star it or deploy it?

If you are a security engineer, a lab evaluation on an isolated range such as a deliberately vulnerable VM is a reasonable way to see how a multi-agent pentester plans, where it loops, and how much a given model matters. If you are a developer who builds agents, the architecture (typed agents, vector memory, a mentor intervention loop, and observability through Langfuse) is worth reading as a reference design even if you never run an exploit.

If your goal is defending your own agents rather than attacking systems, the better use of this repo is as a threat model: it shows how easily a general-purpose LLM can be wired to professional offensive tooling, and what your sandboxing and monitoring must withstand.

Bottom line

PentAGI shows how quickly "AI pentester" has moved from demo to a polished, self-hostable, MIT-licensed project with a real ecosystem around it. The 28K stars say people want it. They do not say how well it finds bugs, and the README publishes no independent benchmark. Treat it as a powerful tool with a sharp edge: valuable on authorized targets, risky anywhere else.

Related reading

• Armadin AI attack swarms and 90 zero-days
• Gemini agents breached three companies
• Felony-bench: AI agent legal liability under the CFAA
• Anthropic cyber verification program
• Anthropic threat intelligence report, September 2026
• Anthropic free scanner for open-source maintainers

Star counts and repo details are as of October 14, 2026 and change quickly.