Breaking

Open-source "PentestAgent" automates penetration testing with an AI agent

July 5, 2026 at 18:40 EDT

AI Agents
Security
Open Source

An open-source framework called "PentestAgent" that automates black-box penetration testing using an AI agent has been released. Distributed on GitHub as GH05TCREW/pentestagent, the MIT-licensed, Python-based tool aims to hand off the full workflow—from reconnaissance through vulnerability analysis, exploitation and report generation—to an LLM agent.

MIT Open-Source · AI Agent Framework

PentestAgent: an LLM Agent That Drives Real Pentest Tools

An open-source framework that automates black-box security testing — bug bounties, red teaming and penetration testing — with LLM agents that parse tool output and autonomously decide the next move, rather than merely wrapping nmap or Metasploit.

~2.7k

GitHub stars

~540

Forks

Operating modes

MIT

License · fully open

Four operating modes

Assist

Single instruction execution

Agent

Autonomous execution

Crew

Multi-agent work

Interact

Dialogue-driven

Distinctive: hierarchical multi-agent

A parent agent dynamically spawns child agents via MCP

Parent Agent

RAG + knowledge graph

→

spawn_mcp_agent

Self-generated children

→

CLI Tools

Metasploit · sqlmap · hydra

What it's credited for

Drives actual CLI tools, not just LLM hallucinations
Structured workflows via playbooks and MCP
End-to-end automation from recon to exploitation
Lets understaffed teams scale continuous validation

Concerns that remain

Fully autonomous exploitation is currently dangerous
Human-in-the-loop seen as essential
Weaker enterprise features than XBOW / ARTEMIS
Hallucination misjudgments, tool reliability, API cost

Requirements & deployment

LLMs
Claude Sonnet, GPT-5 (LiteLLM)

Stack
Python 3.10+, API key, Playwright

Deploy
Local / Docker (Kali image)

Timeline
First commit ~May 2025

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.