A new open-source penetration testing agent, PentestGPT, has been released, designed to automate the process of identifying vulnerabilities in target systems. The framework, developed by Gelei Deng and a team of colleagues, was initially presented at USENIX Security 2024.
PentestGPT operates by leveraging large language models (LLMs) to conduct various stages of a penetration test. In its default autonomous mode, the agent progresses through reconnaissance, exploitation, and a final walkthrough, with each stage informing the next. An alternative "pentest mode" focuses on asset discovery, vulnerability identification, and report generation. This fully automated approach eliminates the need for human intervention during the testing process.
The system drives specific LLMs, including Claude Code and Codex, to execute tools and make decisions on subsequent actions. Installation requires Python 3.12 or newer, the `uv` package manager, and authenticated command-line interfaces for Claude Code and Codex. A Docker image is provided that bundles these CLIs, allowing for a single login and persistent token storage across container recreations. A notable detail for deployment is that ChatGPT refresh tokens are single-use, necessitating OAuth callback forwarding via `socat` for Codex login during initial image setup.
An older design, `pentestgpt-legacy`, offers a human-in-the-loop interactive mode. This legacy version employs three cooperating LLM sessions—one for reasoning, one for generation, and one for parsing—to maintain a Pentesting Task Tree. This interactive mode supports a broader range of LLM providers than the autonomous pipeline, including OpenAI, Anthropic, Google Gemini, DeepSeek, xAI, Qwen, Moonshot, and local models via Ollama. The model registry was last verified in June 2026, and a built-in smoke test is available to confirm the live functionality of configured models.
By default, PentestGPT transmits anonymous usage data to a Langfuse project. This telemetry includes session metadata such as target type, duration, and completion status, as well as a record of tools executed and whether a flag was found. The developers explicitly state that command outputs, credentials, and flag values are never transmitted. Users can opt out of this data collection via a command-line flag or an environment variable.
PentestGPT is freely available on GitHub.
