PentAGI: Let AI Red Teams Run a Full Penetration Test on Their Own

> Project: vxcontrol/pentagi > Stars today: +613 > Language: Go > License: AGPL-3.0 > Positioning: A self-hosted, multi-agent autonomous penetration testing system

---

A Scenario

It's Friday afternoon. Your boss says: "I need the penetration test report for this system by Monday."

The traditional workflow: you open Kali Linux, run nmap to scan ports, run sqlmap to test injection, dig through Metasploit for exploits, manually verify every finding, and write the report. For a mid-sized system, that's at least three days.

PentAGI's solution: you enter the target address and testing objectives, and it plans the steps itself, calls 20+ specialized tools, executes inside a Docker sandbox, remembers every discovery, and hands you a report. You watch it work on screen, stepping in only at key decision points.

---

What It Actually Is

PentAGI = Penetration testing Artificial General Intelligence

In one sentence: you describe the target and objectives; an AI agent team plans, executes, and reports on its own.

But the "on its own" isn't marketing hype. It genuinely decomposes penetration testing into multi-agent collaboration:

1. Planning Agent: analyzes the target and decides what to do first and what to do next 2. Execution Agent: runs tools like nmap, Metasploit, and sqlmap inside a Docker sandbox 3. Memory Agent: stores findings in PostgreSQL + pgvector so later steps can retrieve them 4. Knowledge Graph Agent (optional): uses Neo4j to track relationships between hosts, services, and vulnerabilities 5. Monitoring Agent: handles execution monitoring and task planning, helping smaller models keep up with complex workflows

This is not a toy where "AI calls an API." It is an agent system with real architecture.

---

Core Design: Four Key Decisions

1. Sandbox Isolation — Give Agents Docker, Not the Host Machine

PentAGI's execution environment is a Docker container. Agents run tools inside the container and cannot touch the host machine. This means:

• nmap scans run against isolated networks
• Installing Metasploit won't pollute your system
• When testing ends, containers are destroyed and traces are wiped

The README has a dedicated section titled "Giving agents Docker without giving away the host." This design decision reflects security engineering thinking: you trust the AI agent to run penetration tests, but you don't trust it to never make mistakes.

2. Model Freedom — 10+ LLM Providers

PentAGI's supported LLM provider list reads like an AI company roster:

• Cloud: OpenAI, Anthropic, Google Gemini, AWS Bedrock, Azure OpenAI, DeepSeek, GLM, Kimi, Qwen, MiniMax, Mistral, xAI Grok
• Local: Ollama, vLLM, any OpenAI-compatible gateway

The logic behind this choice: penetration testing scenarios have different model needs. The planning phase needs strong reasoning (use Claude/GPT); the execution phase needs speed and low cost (use DeepSeek/Ollama); the reporting phase needs long context (use Gemini). PentAGI doesn't lock you into a model — users choose per need.

3. Memory System — PostgreSQL + pgvector + Neo4j

Penetration testing is a cumulative discovery process: scan and find port 80 open → try web vulnerabilities → discover a login page → try weak passwords → enter the admin panel → escalate privileges. Every step depends on the previous step's findings.

PentAGI uses two layers of memory:

• PostgreSQL + pgvector: stores execution results and vectorized experience; later steps can semantically retrieve "what similar things were found before"
• Neo4j knowledge graph (optional): tracks the relationship network of host → service → vulnerability → exploit chain

This design ensures agents don't "forget" — the decision at step 20 can reference the finding from step 3 instead of starting from scratch.

4. Observability — Langfuse Integration + Execution Monitoring

The biggest problem with agent systems is "what is it actually doing?" PentAGI integrates Langfuse for LLM call tracing, plus built-in execution monitoring and a task planning interface.

This means you can see: why did the agent decide to scan port 80 before 443? What parameters did it use when calling nmap? What discovery made it change its plan? Observability is the dividing line between an agent "toy" and a real "tool".

---

How It Differs from Other AI Security Tools

| Dimension | CAI (Cybersecurity AI) | PentAGI | Autonomous pentest | |------|----------------------|---------|-------------| | Deployment | Cloud | Self-hosted | Self-hosted | | Model choice | Limited | 10+ providers | Single | | Tool integration | Built-in | 20+ specialized tools | Varies | | Memory system | Basic | PostgreSQL+pgvector+Neo4j | Varies | | Knowledge graph | None | Yes (Graphiti) | Rare | | Observability | Basic | Langfuse + execution monitoring | Weak | | API | Limited | REST + GraphQL | Varies |

PentAGI's differentiation is engineering completeness. It's not an "LLM + prompt" demo — it's a system with sandboxing, memory, a knowledge graph, and observability.

---

A Deeper Observation

PentAGI's architecture reveals a trend: the competitiveness of AI agent systems lies not in the model, but in the architecture.

When everyone can call GPT-6 or Claude, what determines whether an agent is good isn't "which model you use" but:

1. How memory is designed: a simple conversation history, or a vectorized experience library? 2. How tools are orchestrated: serial calls, or planned parallelism? 3. Where the security boundaries are: what can the agent do and what can't it do? 4. How strong observability is: when something goes wrong, can you trace it?

PentAGI made deliberate choices on all four dimensions rather than defaults. That's why a +613-star project deserves serious attention — it isn't the hottest, but its architecture design is textbook-level.

---

Who It's For

• Security engineers / penetration testers: want an assistant that works 24/7
• Red teams: need automated initial recon and vulnerability verification
• Security researchers: want to study multi-agent system behavior in attack/defense scenarios
• Enterprise security teams: need self-hosted (data stays in-domain) automated testing

Not for:

• People who want to use it for malicious purposes (PentAGI is explicitly for authorized testing only)
• Script kiddies expecting "one-click pwn" (agents still need human intervention at critical points)
• People who don't want to self-deploy (PentAGI is self-hosted and requires a Docker environment)

---

Enterprise Edition

PentAGI Enterprise adds:

• Agent profiles (different agent configurations for different tasks)
• Plugins and MCP servers (extensibility)
• Client-grade reporting (penetration test reports delivered directly to clients)
• Real-time attack chain visualization

The open-source edition is already feature-complete; the enterprise edition adds "team collaboration" and "client delivery" capabilities.

---

One-Sentence Summary

PentAGI turns penetration testing from "one person + a pile of tools" into "one person + a team of AI agents." Its value isn't in "what AI can hack," but in demonstrating how a serious agent system should be designed — with sandboxing, memory, a knowledge graph, and observability. While everyone talks about "AI agents," PentAGI shows you what "AI agent systems engineering" looks like.