An open-source ai pentest platform that turns your infrastructure into an autonomous red team — a coordinator agent plus specialist sub-agents running 20+ real offensive tools inside Docker sandboxes. Here is what it is, how it works, and why its containment design is the real story.
Sources: repository metadata and project documentation as reported by Help Net Security, dev.to, vpncentral, and aiagentstore (summarized, not quoted). Star counts are snapshots from October 2026 and move daily.
| Tool | Purpose | Role in PentAGI |
|---|---|---|
| Nmap | Network discovery | Port scanning, service enumeration |
| Metasploit | Exploitation | Payload delivery, exploit modules |
| SQLMap | Database attacks | SQL injection testing |
| Nuclei | Vulnerability scanning | Template-based checks |
| Burp Suite | Web app testing | Traffic interception and analysis |
20+ tools chain automatically; the agents select based on target. A code-reading review of the shipped prompts reports a larger named tool inventory behind the pentester role — treat the 20+ figure as the documented floor, not the ceiling.
A pentesting agent is the most dangerous agent archetype there is: shell access, exploit frameworks, and network scanning in one autonomous system. If those capabilities ever leak their sandbox, the agent itself becomes the threat.
PentAGI is interesting because it answers that danger with architecture, not policy:
This is the same containment thesis we build on: an agent cannot be its own security authority — safety has to live in the walls around it, not in its good intentions. PentAGI is the open-source case study. HexStrike AI hands agents 150+ tools over MCP; Watchtower runs its own LangGraph agent loop. PentAGI sits between them: the most-starred fully autonomous option, caged by design.
| Project | Model | Scale (reported, Oct 2026) |
|---|---|---|
| PentAGI | Fully autonomous multi-agent team, Docker-sandboxed | ~29,000 stars (reported) |
| PentestGPT | Human-in-the-loop pioneer — guides the tester, doesn't run alone | ~16,000 stars (reported) |
| HexStrike AI | MCP server exposing 150+ tools to any compatible agent | ~12,900 stars (reported) |
PentAGI is the most-starred of the autonomous options; the human-in-the-loop and tool-server patterns solve different problems. See also BreachHunter vs human pentesters.
Answer honestly. "Yes" isn't always the right answer — two of these are traps.
PentAGI (github.com/vxcontrol/pentagi) is an open-source, MIT-licensed, self-hosted platform that runs penetration tests with a team of specialized AI agents: a coordinator plans the engagement while sub-agents handle reconnaissance, scripting, setup, and offensive operations. All offensive work runs inside isolated Docker containers, and it supports 12+ LLM providers including local models via Ollama.
You describe a target and a goal in plain language. An orchestrator agent breaks the work into flows, tasks, subtasks, and actions, then delegates to specialist sub-agents - for example searcher agents for OSINT and web lookups, coder agents that write scripts, installer agents that handle dependencies, and pentester agents that run the offensive tooling. Findings are stored in PostgreSQL with pgvector for semantic recall, and Neo4j-backed knowledge graphs keep context across long engagements.
A pentesting agent is the most dangerous agent archetype: shell access, exploit frameworks, and network scanning in one system. PentAGI contains that power by architecture rather than by policy: every offensive operation runs inside Docker sandboxes (never a shell on the host), each sub-agent is scoped to only the tools its role needs (least privilege by design), and being self-hosted means no target data leaves your infrastructure. The tool that attacks is the lesson in containing agents.
A code-reading review of the repository notes there is no breach-and-attack-simulation (BAS) support and no JSON report export; findings still require human verification before they can be treated as real; and the authorized-testing boundary is explicit - only assess systems you own or are explicitly authorized to test. Star counts move daily, so treat figures as snapshots.
Only against systems you own or have explicit written authorization to assess - authorized penetration tests, bug-bounty programs within scope, CTFs, and lab environments. Running autonomous offensive tooling against anything else is unauthorized access, regardless of the tool. This page gives no installation or run instructions by design.
Filed under Penetration Testing by Ingenious AI — see the related checks above for more in this series.