PentAGI: an AI pentest team you run yourself
PentAGI is an MIT-licensed, self-hosted multi-agent pentest tool. A public $1.39 run found 11 issues in a training app. Its defaults and local-model needs deserve a read first.
Facts checked October 14, 2026
PentAGI is a self-hosted system where AI agents plan and run penetration tests with standard tools inside Docker. One published run against a deliberately vulnerable app cost $1.39. The project's own files show defaults to change before deploying. I read the code and docs at commit 843dfeb and ran nothing. Repository
What the project says it is
The README describes PentAGI as an open-source, self-hosted multi-agent system for autonomous penetration testing. You describe a target and a goal in plain language. Specialized agents plan the work, run 20+ tools such as nmap, Metasploit and sqlmap inside a Docker sandbox, store what they learn, and write a report. The stack lists a Go backend with REST and GraphQL APIs, a React and TypeScript front end, and PostgreSQL with pgvector for memory. The LICENSE file is the MIT License.
READMEThe public run people cite
Paola Garcia Cardenas published a first-person run on April 12, 2026 against OWASP Juice Shop, an app built to be vulnerable. She reports about 38 minutes of runtime, 15 tasks and $1.39 of OpenAI API cost. The agents produced 11 findings, and curl proof-of-concept requests for the three top unauthenticated ones: reflected XSS, a backup file disclosure and a CORS misconfiguration. The final report included CVSS scores. This is one author's account of an easy target, and I did not reproduce it.
Paola Garcia Cardenas: Autonomous Pen Testing with PentAGIDefaults to change before you deploy
In docker-compose.yml, the PentAGI service mounts the host Docker socket and runs as root, with a comment saying so. In .env.example, a security note says that giving sandbox containers the Docker socket can let a prompt-injected agent reach the host. DOCKER_INSIDE defaults to false there, and the note suggests a least-privilege socket proxy if you need it. The same file ships sample passwords such as postgres and devpassword, each marked 'change this to improve security'. Treat the quick start as a development setup.
.env.exampleLocal models take real hardware
Running free local models needs more than the README's minimum of 2 vCPU, 4 GB RAM and 20 GB disk, which covers the application. For Ollama the README asks for a 110K context window, and says num_ctx can only be set when the model is created, through a Modelfile. Its production example uses Qwen3.5-27B-FP8 on four RTX 5090 GPUs. For models under 32B parameters the README calls execution monitoring and task planning essential. They are off by default (EXECUTION_MONITOR_ENABLED=false) and cost 2 to 3 times the time and tokens for about twice the quality, measured by the project on Qwen3.5-27B-FP8.
What an internal security team and the maintainers said
In GitHub discussion #217 (March 19, 2026) an internal security team reported a 10 to 30% false positive rate, findings that needed manual triage, and weak business-logic coverage. It called PentAGI a fast first-pass tool. The maintainers replied that the assessment is broadly fair for the public version, with a minimal initial prompt. They added that a task scoped to one category, such as SQL injection, gives better results than a broad one. That 10 to 30% is one team's observation, not a measured rate for the tool.
Discussion #217The cost picture
The software is MIT-licensed. Running it has three possible costs: API spend on long autonomous runs, GPUs for the local path, and your time. RedSecLabs puts the last one plainly: you still define the target, approve actions, interpret results and carry legal and professional responsibility.
RedSecLabs: my take on PentAGIAnalysis: my inference
The $1.39 run shows what the tool can do on a known-vulnerable target with a paid model. It says little about a messy production system. The documented socket mount makes the sandbox itself part of your threat model, so run it on an isolated host. Use it for first-pass leads on systems you own or have written permission to test, with a narrow task, and review every finding before anyone acts on it.
What I could not confirm
I did not run PentAGI or reproduce any result. I found no public benchmark that compares local model sizes on identical targets [unverified]. Third-party reviews I read are secondary and I cite them only for what they say about their own experience.
Method
Code and documentation read directly at commit 843dfeb (October 9, 2026). Nothing was installed or executed. Hands-on results are attributed to their authors.
Illustrative pre-deployment checklist, not executed
[ ] run on an isolated host you own, not a shared workstation
[ ] change every sample password in .env (postgres, devpassword, ...)
[ ] review the Docker socket mount; keep DOCKER_INSIDE=false unless needed
[ ] written permission for every target, scope stated in the task
[ ] one narrow task per run (one vulnerability class)
[ ] local model: Modelfile with num_ctx 110000; enable monitoring + planning if < 32B
[ ] a human checks every finding before anyone acts on it