PentAGI: An Autonomous AI Penetration Testing Platform with a Sandboxed Docker Core

What Problem PentAGI Solves

PentAGI automates penetration testing tasks that normally require a human to manually run a sequence of tools like nmap, metasploit, and sqlmap. The project's stated goal is to let an AI agent determine and execute the steps of a penetration test, with optional human monitoring and task planning. It is aimed at information security professionals, researchers, and enthusiasts who want a self-hosted solution. The core problem it addresses is the labor and time cost of orchestrating multiple security tools across a target. Instead of a script that runs a fixed set of commands, PentAGI's agent can decide what to run next based on previous outputs. This is a different approach from a traditional vulnerability scanner, which follows a predefined checklist. The README positions it as a platform for autonomous and assistant-guided testing, not as a breach and attack simulation product.

Sandboxed Docker Execution and Container Management

All operations happen inside a sandboxed Docker environment, which is the project's primary security boundary. The README emphasizes complete isolation, meaning the AI agent does not run directly on the host. This is a significant design choice. The platform also performs automatic Docker image selection based on the task at hand. The README mentions a specific section titled 'Giving agents Docker without giving away the host', which suggests there is a documented pattern for granting the agent access to Docker while limiting host privileges. That distinction matters: an autonomous agent that can launch containers is powerful, but it can also be dangerous if the container escape surface is not carefully controlled. The documentation does not detail the exact isolation mechanisms, so a user should inspect the Docker Compose files and container configurations before trusting the isolation claim. The microservices architecture supports horizontal scaling, which is useful if you plan to run multiple concurrent tests.

Agent Supervision and Task Planning

A notable feature is the 'Team of Specialists' delegation system. The agent can delegate work to specialized sub-agents for research, development, and infrastructure tasks. This is not a single monolithic agent. The README states that this delegation is enhanced with optional execution monitoring and intelligent task planning, which is designed to work better with smaller models. That is a practical concession: smaller LLMs may not handle a long, complex task in one pass, so splitting the work across specialists can improve reliability. The system also has a smart memory system that stores research results and successful approaches for future use. This memory is persistent, stored in PostgreSQL with the pgvector extension. The implication is that PentAGI can learn from previous engagements, though the README does not specify how the memory is retrieved or weighted. The knowledge graph integration with Graphiti and Neo4j is optional, so you can run without it if you want a simpler setup.

Deployment and Configuration: Docker Compose and LLM Providers

Quick deployment is handled through Docker Compose, which is the standard path for a self-hosted service. The README lists a comprehensive environment configuration, but it does not show the actual compose file or all environment variables in the provided excerpt. You will need to clone the repository and read the configuration files. The platform supports over 10 LLM providers, including OpenAI, Anthropic, Google Gemini, AWS Bedrock, Ollama, DeepSeek, GLM, Kimi, Qwen, and MiniMax, plus aggregators like OpenRouter and DeepInfra. There is also a custom/OpenAI-compatible endpoint option. For production local deployments, the README points to a guide for vLLM with Qwen3.5-27B-FP8, which suggests that running a local model is a supported scenario. This is important for users who cannot send data to external APIs. The README also documents OAuth integration for GitHub and Google, and Langfuse integration for observability. Monitoring is available through Grafana and Prometheus, which is a concrete operational feature.

APIs and User Interface

PentAGI exposes both REST and GraphQL APIs, protected by Bearer token authentication. This allows programmatic automation and integration with other systems. The web UI is described as clean and intuitive, and it supports viewing flow reports in web, copy-to-clipboard, Markdown download, and PDF download. Notably, the README explicitly states that JSON flow-report export is not documented as a supported output format in the current version. That is a real limitation if you want to ingest reports into another tool. The APIs are a differentiator: many similar projects only offer a UI. Having a GraphQL endpoint is useful for building custom dashboards or triggering tests from a CI pipeline. The README does not provide example API calls or authentication details in the excerpt, so you would need to read the source or any API docs in the repository.

Limitations and Wrong Tool Scenarios

The README is unusually candid about what PentAGI is not. It is not a CALDERA-style Breach and Attack Simulation (BAS) product with predefined campaigns or attack plans. If you need automated adversary emulation with fixed attack paths, this is the wrong tool. The README also states that BAS-like agent-authored attack scripts are conceptual or future work, so do not expect that feature today. The JSON flow-report export gap is another concrete limitation. Additionally, the platform's reliance on an LLM means that the quality of the test depends heavily on the model's ability to reason about security tasks. A weak model could produce incomplete or incorrect results. The README does not mention any safety mechanisms beyond the Docker sandbox, so you should assume that the agent might attempt actions that are unexpected. Running this against production systems without careful monitoring is risky. The optional execution monitoring feature is there to mitigate that, but it is optional.

Alternatives and Comparison

The most direct alternative is a traditional penetration testing framework like Metasploit, which is also included as one of PentAGI's built-in tools. The difference is that Metasploit is a manual or scripted tool; you write the exploit logic or run modules by hand. PentAGI is an AI agent that decides which Metasploit module to use. Another alternative is a BAS platform like CALDERA, which the README explicitly contrasts with. CALDERA uses predefined adversary profiles and attack groups, so it is deterministic and repeatable. PentAGI is not deterministic: the agent's actions depend on the LLM's outputs, which can vary. If you need repeatable, auditable attack simulations, CALDERA is a better fit. If you want an AI-driven exploration of a target, PentAGI is the intended tool. The README does not compare itself to other AI pentesting tools like those from commercial vendors, so you would need to evaluate those separately.

Maintenance, License, and Upgrade Considerations

PentAGI is licensed under MIT, which is permissive and allows commercial use, modification, and redistribution with attribution. This is a low-risk license for integration. The project is actively maintained, with recent releases including v2.1.0 from May 2026. The versioning suggests a steady release cadence. The maintenance cost is not trivial: you are running a microservices architecture with PostgreSQL, pgvector, and optional Neo4j, plus integration with search APIs and LLM providers. That is a lot of moving parts. Upgrading between versions may require database migrations, and the README does not describe an upgrade path. You should also budget for the cost of LLM API usage if you use cloud providers. The platform's dependency on external services like Tavily, Firecrawl, or Perplexity for web intelligence means you need accounts and API keys for those services if you want that feature. The README does not specify whether these are mandatory or optional, so you may be able to run without them, but the web intelligence feature is a headline capability.

Editorial conclusion

Adopt PentAGI if you are a security professional or researcher who wants an autonomous AI agent to run penetration tests inside isolated Docker containers, and you are comfortable managing a microservices stack with PostgreSQL, pgvector, and optional Neo4j. Do not adopt it if you need predefined attack campaigns or JSON flow-report export, as the README explicitly states these are not current capabilities. Before deploying, verify that your target environment permits outbound network access from the sandbox and that your chosen LLM provider can handle the context volume of multi-step testing. Confirm the exact Docker Compose configuration and environment variables from the repository, since the README does not list every key in this version.

Official sources

1. Official documentation
2. Official README
3. Project repository
4. Release notes