Breaking

Open-Source AI Agent PentestAgent Automates Black-Box Penetration Testing

June 30, 2026 at 01:17 EDT

AI Agents
Security
Open Source

An open-source AI agent framework called PentestAgent, which automates black-box penetration testing against targets whose internal structure is unknown, has drawn attention within the developer community. Developed by GH05TCREW (developer Masic) and distributed under the MIT license, it is officially described as supporting bug bounty, red-team and penetration testing workflows. GitHub

Open Source · AI Security Tooling

PentestAgent: AI Agents Run the Full Penetration-Testing Workflow

An MIT-licensed framework that distributes reconnaissance, vulnerability analysis, and exploitation across specialized LLM agents — aiming to compress engagements that average roughly 80 hours of manual work.

~80 hrs

Average manual pentest engagement targeted for automation

~2,700

GitHub stars at time of crawling

Execution modes: Assist · Agent · Crew · Interact

128

Tool threshold that triggers the RAG optimizer to narrow tools

Automated Workflow

Reconnaissance

nmap · scans

→

Vulnerability Analysis

RAG knowledge

→

Exploitation

Metasploit · sqlmap · Hydra

A parent agent dynamically spawns child agents via MCP; predefined Playbooks (e.g. thp3_web) drive black-box assessments end to end.

Vulnerability Analysis Time

PentestAgent (paper) spends more time per analysis — but trades it for a higher success rate vs the earlier PentestGPT.

433.5s

PentestGPT

698.8s

PentestAgent (paper)

Also reports higher all-stage completion rates, with the biggest gains in recon and exploitation.

Praised For

Efficiency from autonomous execution
Predefined attack Playbooks
HexStrike integration
Fast bug-bounty recon & red-team simulation

Open Challenges

Complex MCP & RAG setup
Ongoing LLM usage costs
Dependence on the Docker environment
Manual work still needed for business-logic flaws

Continue reading

The rest of this article is for AI News Blitz readers. Choose an option below to keep reading.