The Open-Source Pentest Agent That Admits What It Can't Do

Every few months, the security world rediscovers that penetration testing is mostly tedious work punctuated by moments of insight. Reconnaissance, enumeration, tool chaining, report writing — the parts that burn junior consultant hours — are exactly the parts an AI agent can grind through without complaint. That observation is now an industry: Synack has Sara working alongside its human red team, XBOW claims human-quality results in a week, and Escape is marketing agentic pentesting as the synthesis of human depth and machine speed. Nearly all of it is commercial and closed.

PentAGI, released on GitHub by VXControl in early 2025, is the open-source counterpoint. It’s a self-hosted platform where a fleet of specialized AI agents — researcher, developer, executor, plus a supporting cast of advisers, reflectors, and memorists — plan and execute penetration tests against targets you own, inside sandboxed Docker containers, using a suite of 20-plus professional tools including nmap, Metasploit, and sqlmap. It has picked up the usual trappings of a hyped repository: a Trendshift badge, Discord and Telegram communities, and coverage placing it among the top open-source security tools for 2026. But the interesting story isn’t the tool count. It’s what the project has learned about making autonomous agents actually finish their work.

The glue is the product

Strip away the branding and PentAGI is, at its core, an orchestration layer. The individual tools it drives are decades old. The LLMs are everyone else’s. What VXControl built is the connective tissue: a Go backend exposing REST and GraphQL APIs, a React frontend, an async task queue, and a data model that decomposes every engagement into flows, tasks, subtasks, and actions, with artifacts and memories attached at the leaves. Every command and its output is persisted in PostgreSQL with the pgvector extension, which means the system’s history is queryable by semantic similarity rather than by grep.

This is unglamorous, and it is precisely where the value lives. The hard problem in agentic security work isn’t running nmap — it’s remembering what nmap told you three subtasks ago, deciding what to do with that information, and not repeating yourself. PentAGI’s architecture treats that as a first-class concern, with separate long-term, working, and episodic memory systems, and an optional knowledge graph built on Graphiti and Neo4j that captures relationships between tools, targets, vulnerabilities, and techniques as an engagement unfolds.

The deployment story is similarly pragmatic. Everything runs as containerized microservices — the site lists an observability stack of Grafana, Loki, Jaeger, OpenTelemetry, and VictoriaMetrics, plus Langfuse for LLM-level tracing backed by ClickHouse, Redis, and MinIO. That’s a lot of moving parts for a pentest tool, but it reflects an honest assumption: if you’re going to let an agent run offensive tooling autonomously, you had better be able to watch every decision it makes. The project even recommends a two-node architecture for production, isolating the worker containers that execute untrusted code onto separate hardware.

Supervision: the part worth reading about

The README’s most revealing section is buried under the heading “Advanced Agent Supervision,” and it documents a finding that generalizes well beyond security work: small models get lost.

PentAGI’s answer is a layered babysitting system. An execution monitor watches for agents repeating identical tool calls — the death spiral of agentic workflows — and invokes a mentor agent that appends analysis to tool responses, nudging the worker toward different strategies. A planner decomposes subtasks into three to seven concrete steps before specialists begin. A reflector intervenes when a model fails to produce valid tool calls after three attempts. Hard tool-call limits — 100 for general agents, 20 for utility agents — guarantee graceful termination regardless of what the supervision modes catch.

The numbers the project reports from testing with Qwen3.5-27B-FP8 are a candid trade-off: enabling monitoring and planning roughly doubles token consumption and execution time, and in exchange roughly doubles result quality. That’s a 2x improvement in completeness, accuracy, and attack coverage — specifically for models under 32 billion parameters. The framing matters. This isn’t a claim that supervision makes small models frontier-class; it’s a claim that supervision makes small models usable, which is a different and arguably more useful engineering result. It’s also the enabling condition for the project’s most strategically interesting deployment mode: fully air-gapped pentesting with local inference, where a vLLM-served open model on four RTX 5090-class GPUs can run a dozen concurrent flows with no cloud dependency at all.

The context problem nobody brags about

Beneath the supervision layer sits another piece of engineering that gets no marketing attention because it’s boring by nature: chain summarization. Long agentic sessions blow past context windows. PentAGI’s solution converts conversation history into a structured representation, selectively summarizes older sections while preserving tool calls and their responses, and keeps recent QA pairs intact — with byte budgets (50KB for the last section, 64KB for QA sections, and larger allowances for assistant contexts) that keep the whole thing under control.

This is the kind of plumbing that determines whether an autonomous agent survives hour two of an engagement. The coverage tends to focus on the 20-plus tools and the multi-agent theater, but a pentest agent that forgets what it learned during reconnaissance is just an expensive random walk. The summarization system, the vector-backed memory, and the supervision loop are three faces of the same problem: sustaining coherent behavior over a horizon longer than a chat session.

Honest beta labels, which is rarer than it should be

Two things distinguish PentAGI’s documentation from the norm in this space. The first is a section literally titled “Current Capability Boundaries” that states, plainly, that PentAGI is not a CALDERA-style breach-and-simulation product, that agent-authored attack scripts are conceptual future work, and that JSON report export doesn’t exist yet. In a market where vendors blur the line between scanning, simulation, and pentesting as a matter of course, a project that volunteers its own limitations is doing something unusual.

The second is the equally frank documentation of the Graphiti knowledge graph’s constraints: it’s beta, it only works against a single OpenAI-compatible endpoint regardless of which provider powers your actual flows, it uses one fixed model for all extraction, and it bills independently even when your agents run on Anthropic or a local model. There’s no in-app graph explorer yet — you’re browsing Neo4j directly. None of this is disqualifying, but it’s the difference between a feature list and a feature.

Where it sits in a crowded field

The agentic pentesting conversation has quickly converged on a consensus position: agents handle discovery, enumeration, hypothesis generation, and evidence collection; humans retain judgment on exploitability, business impact, and high-risk decisions. Synack describes mature programs pairing agents with human oversight and audit trails. Picus argues automated testing is a force multiplier for known attack paths while manual testers keep the novel and business-logic work. CyCognito’s comparison lands in the same place, as does Contrast’s DevSecops framing of continuous automated validation alongside deeper human work.

PentAGI fits this picture as the self-hosted, provider-agnostic instrument of it. Where Synack and XBOW sell outcomes, PentAGI sells infrastructure — you bring the targets, the authorization, and the LLM budget. Its provider support is genuinely broad: OpenAI, Anthropic, Google, Bedrock, Ollama, DeepSeek, GLM, Kimi, and Qwen, plus any OpenAI-compatible endpoint and LiteLLM as a unifying proxy. The per-agent model assignment tables in the documentation read like a cost-optimization handbook, mapping cheap fast models to utility agents and flagship reasoners to the generator and adviser roles.

The assistant mode deserves a mention here, because it’s where the human-in-the-loop consensus actually gets implemented. Every autonomous flow has an assistant view for steering — clarifying scope, redirecting after intermediate findings, patching remaining subtasks — which positions PentAGI less as a replacement for the pentester and more as the delegation target Synack’s topology diagrams describe: routine collection below, consequential reasoning above.

Friction, and there is some

The rough edges are visible and documented. OpenAI’s GPT-5 series models, which the project flags as working unstably with PentAGI, can trip OpenAI’s cybersecurity safety mechanisms without verified access — the README points users toward identity verification or the o-series and GPT-4.1 models instead. It’s a telling wrinkle: the frontier models most capable of autonomous offensive reasoning are also the ones most actively gated against exactly that use. AWS Bedrock’s default quotas for Claude models are restrictive enough that the documentation tells you to expect workflow interruptions without quota increases. And users manage their own LLM costs and rate limits entirely — the coverage flags this as the platform’s main operational burden, and the supervision features that make small models viable also double the token bill when enabled.

There’s also the question of what “autonomous” means in practice. The project’s own guidance recommends starting with narrow targets and single objectives, and its prompt methodology section reads like a manual for compensating for everything agents still do badly — scope creep, unvalidated findings, fixation on a single attack vector. The supervision system exists because the failure modes are real.

Outlook

The unresolved tensions are instructive. The Graphiti knowledge graph is the project’s most ambitious memory play and its least mature component — OpenAI-only, single-model, no UI. Cross-flow knowledge reuse currently requires deliberate workflow: durable findings must be stored explicitly as guides or answers rather than emerging automatically from execution history. And the gap between “autonomous pentesting platform” and the BAS-style scripted adversary emulation the README explicitly disclaims is where the field’s expectations are heading, whether or not PentAGI follows.

What PentAGI has established is that the open-source baseline for agentic security testing is no longer a weekend wrapper around an LLM API. It’s a full observability stack, a memory architecture, a supervision regime tuned for models small enough to run on your own hardware, and documentation honest enough to say which parts are beta. The commercial players are selling the conclusion that agents plus humans beat either alone. PentAGI is selling the ability to run that experiment yourself — and, unusually for this space, telling you up front which experiments will fail.