# PentAGI: What an Autonomous AI Pentesting Agent Means for Your Security Program

> PentAGI is a real, 24k-star open-source AI agent that plans and runs penetration tests with Nmap, SQLMap and Metasploit. What it does, how it is governed, and what security leaders should check before anyone on the team runs it.

Source: https://playciso.com/blog/pentagi-autonomous-ai-penetration-testing-agent · Published: 2026-09-14 · Publisher: PlayCISO (https://playciso.com)

---

"You give it the system that's allowed to be tested. It researches the target. Plans the security test. Runs the tools. Reports the vulnerabilities it finds." That is a fair one-line summary of [PentAGI](https://github.com/vxcontrol/pentagi) (vxcontrol/pentagi), an open-source, MIT-licensed autonomous AI agent system with more than 24,000 GitHub stars and 3,000+ forks that has quietly become one of the more capable AI-driven penetration testing platforms available to download and run today. It is real, it is actively developed, and it uses actual offensive-security tooling — not a simulation of it. This is what it does, how it is put together, and what it changes for a security program that adopts it. ## What PentAGI actually does PentAGI describes itself as a "fully autonomous AI Agents system capable of performing complex penetration testing tasks." In practice, you start an engagement ("flow") with a natural-language prompt that names the target, the type of assessment, and the scope and rules of engagement — something like _"Assess https://target.example for common web application vulnerabilities. Focus on authentication, file handling, and injection issues."_ From there the system: - Researches the target using a built-in browser and external search APIs (Tavily, Firecrawl, Google, DuckDuckGo, Perplexity and others) to gather context before touching anything. - Plans the assessment, breaking the objective into steps and delegating them across specialized agent roles. - Runs real tools — more than 20 professional security tools, including Nmap, SQLMap and Metasploit — inside isolated Docker containers. - Reports findings, producing a vulnerability report with exploitation guidance, available as a web view, Markdown, or PDF. It runs in two modes. **Automation** lets it work end to end without intervention. **Assistant** keeps a human in the loop, approving or redirecting each step — the more defensible default for anyone actually adopting this inside a security program rather than kicking the tires on a lab target. ## Architecture: more than a wrapper around a chatbot PentAGI is a genuine multi-service application, not a single prompt with tool access bolted on. The stack: a Go backend and React frontend, PostgreSQL with pgvector for semantic memory (so it can recall prior research and successful approaches across a long engagement), an async task queue, and an optional Neo4j/Graphiti knowledge graph for tracking relationships between findings. There is a full observability stack — OpenTelemetry, Grafana, Prometheus/VictoriaMetrics, Jaeger and Loki — and REST/GraphQL APIs with Bearer-token auth. Installation is via an interactive terminal installer or a manual `docker compose up -d`, with a documented minimum of 2 vCPU, 4GB RAM and 20GB disk. This is built to be operated, not just demoed. ## Runs on cloud models or entirely on your own hardware The pitch that it "can work with local AI models on your own server" is accurate and is one of the more consequential design choices here. PentAGI supports commercial providers — OpenAI, Anthropic, Google Gemini, AWS Bedrock, DeepSeek — alongside fully self-hosted options through Ollama and vLLM, plus any custom OpenAI-compatible endpoint. For a security team, that means target reconnaissance, tool output and draft findings never have to leave infrastructure you control, which matters considerably more here than it does for a general chatbot: this agent's "context" is your client's attack surface. ## The authorization line, stated plainly To its credit, the project does not hedge on this. Its documentation states: _"Only test systems you own or are explicitly authorized to assess. See EULA.md for the acceptable use requirements."_ That is the correct default for a tool that can autonomously drive Metasploit against a target it was merely told is "allowed to be tested." An autonomous agent does not change what unauthorized scanning or exploitation is — it just makes it faster to start, which is exactly why the scope you hand it needs to be as precise as a signed statement of work, not a Slack message. ## What this means for a security program The productivity case is real: research, tool execution and first-draft reporting are the hours-long, low-judgment parts of a pentest that an experienced tester still has to grind through. An agent that reliably automates that grind and hands a human the interesting findings to verify is a genuine efficiency gain, not a gimmick. The governance work that comes with adopting it is also real, and it is the same governance work every agent with tool access and real credentials requires: - Isolate it. Run PentAGI in an environment with no standing access beyond the authorized engagement, on infrastructure you would be comfortable discarding. The project's own Docker-container isolation is a start, not a substitute for network-level containment on your side. - Write the scope into the prompt like a contract. The natural-language target and rules-of-engagement prompt is the only thing standing between "authorized assessment" and "unauthorized access." Treat it with the precision of an SOW, not a one-liner. - Treat the agent as an identity, not a black box. It holds credentials, runs exploitation tooling and produces findings that themselves are sensitive. Score its blast radius the way you would any service or AI identity with the free Identity Risk Calculator. - Vet whatever model you point it at. If you run PentAGI against a self-hosted model to keep engagement data in-house, that model's own provenance matters — a refusal-removed or "abliterated" local model changes the risk calculus of what the agent will attempt without pushback. Our guide to abliterated models and the free Abliterated Model Risk Calculator cover exactly that decision. - Audit any tool-calling configuration. An agent that plans and executes tool calls is the same architectural pattern covered in our brief on tool-call injection through a compromised LLM router — the same discipline (least privilege, validated tool-call arguments, human approval for consequential actions) applies whether the tools are internal APIs or Metasploit modules. ## The takeaway PentAGI is not vaporware and it is not a toy: it is a well-built, actively maintained, genuinely capable autonomous pentesting platform that a real red team could put to work today, cloud-hosted or entirely offline. That capability is exactly why it deserves the same disciplined adoption process as any other tool that gets to run exploitation tooling with real credentials against real infrastructure — scoped, isolated, and governed, with a human owning the outcome even when the human isn't the one holding the keyboard. ## Frequently asked questions **What is PentAGI?** PentAGI is an open-source, MIT-licensed autonomous AI agent system (github.com/vxcontrol/pentagi) that performs penetration testing tasks: it researches a defined target, plans a security assessment, executes real offensive-security tools such as Nmap, SQLMap and Metasploit (20+ tools total), and produces a vulnerability report with exploitation guidance. It runs in isolated Docker containers and supports both a fully autonomous "Automation" mode and a step-by-step "Assistant" mode with a human approving each stage. **Does PentAGI require a cloud AI model, or can it run fully offline?** Either. PentAGI supports commercial providers (OpenAI, Anthropic, Google Gemini, AWS Bedrock, DeepSeek and others) and self-hosted local models through Ollama or vLLM, plus any custom OpenAI-compatible endpoint. Running it against a local model keeps target data and findings off a third-party API entirely, which is one of the more genuinely useful properties for an internal red team. **Is it legal to run PentAGI against a target?** Only against systems you own or are explicitly authorized to test, exactly as with any other pentesting tool. PentAGI's own documentation states this directly and points to its EULA for acceptable-use terms. Running Nmap, SQLMap or Metasploit through an autonomous agent does not change the legal line — unauthorized scanning and exploitation are still unauthorized, whoever or whatever is driving the keyboard. **How is PentAGI different from a Breach and Attack Simulation (BAS) tool like Caldera?** PentAGI positions itself explicitly as not a BAS product. A BAS platform runs predefined, scripted attack campaigns to test whether existing detections fire. PentAGI instead does open-ended reasoning: it researches an unfamiliar target, decides what to try, and adapts based on what it finds — closer to a junior pentester's actual workflow than a canned campaign. **What should a security leader check before letting a team use it?** The same controls you'd require of any agent wired to real tools and real credentials: run it in an isolated, disposable environment with no standing access beyond the authorized scope; write the scope and rules of engagement into the prompt as precisely as you would into a statement of work; treat the agent's own access as a non-human identity that needs review, not a black box; and if you point it at a self-hosted model, vet that model's provenance the same way you would any other AI supply-chain component.