pentagi: Autonomous AI Agents for Penetration Testing

TL;DR: vxcontrol/pentagi is a 23,468-star self-hosted multi-agent system in Go that orchestrates Anthropic and OpenAI models to autonomously perform complex penetration testing tasks, with a GraphQL API and React frontend.

vxcontrol/pentagi is described as a “fully autonomous AI Agents system capable of performing complex penetration testing tasks.” The project sits at the intersection of AI agent frameworks and offensive security tooling, with 23,468 stars and 3,062 forks as of this writing. The most recent push was September 10, 2026, and the project page lives at pentagi.com.

The architecture is the interesting part. Pentagi runs as a self-hosted service — a Go backend exposing a GraphQL API, paired with a React frontend for human interaction. Inside, a multi-agent system coordinates several specialized agents, each handling a slice of the pen testing workflow: reconnaissance, vulnerability analysis, exploitation planning, and report generation. Topics on the repo include ai-agents, ai-security-tool, anthropic, autonomous-agents, golang, gpt, graphql, multi-agent-system, offensive-security, openai, penetration-testing, security-automation, self-hosted, and react. That breadth tells you the project ships the full stack, not just a model wrapper.

The license is MIT, which is unusually permissive for an offensive security framework. Most pen testing tools ship under GPL or a custom “research only” license. Pentagi’s MIT release means you can fork it, modify it, and ship a derivative product without source disclosure — though you would obviously need your own authorization before running it against any real target.

For security professionals, the value is automation of the boring parts of a pen test. Reconnaissance, asset enumeration, and initial vulnerability scanning eat hours that could go to deeper analysis. Pentagi packages those phases into agent calls that produce structured outputs the security engineer can review and triage. The system is not a replacement for human judgment, but it does compress the time between starting a test and finding actionable findings.

For AI engineers, the project is a reference implementation of a production-grade multi-agent system. The codebase shows how to coordinate multiple specialized agents, how to handle tool use across different model providers, how to expose agent state through a GraphQL API, and how to ship a usable frontend that is not a chat window. Reading the architecture is more useful than reading another agent framework tutorial.

The model support covers both Anthropic and OpenAI, with Anthropic tags explicitly mentioned. In practice this means the framework is not tied to a single vendor — you can route different agents to different models based on cost, latency, or capability. The multi-agent-system topic confirms there is orchestration logic beyond simple prompt chains.

Important caveats apply. First, autonomous security testing is legal only against systems you own or have explicit written authorization to test. Running pentagi against a third-party system without authorization is illegal in most jurisdictions. Second, the “autonomous” framing in the description is aspirational — human review of the agent’s actions is still required for responsible use. Third, the model outputs may include false positives that need human verification before being treated as real vulnerabilities.

For deployment, the self-hosted framing means you run pentagi on infrastructure you control. The Go binary and React frontend are the deployment surface; bring your own model API keys for Anthropic or OpenAI, configure your target scope, and the agents start working. Expect to spend time tuning the agent prompts to your specific environment before the results are useful.

Source and Accuracy Notes

• Project page: https://github.com/vxcontrol/pentagi
• Source repository: vxcontrol/pentagi (verified via GitHub API html_url)
• License: MIT (verified via GitHub API license.spdx_id)
• Stars at time of writing: 23,468