Skip to content
EventPast event

PentAGI multi-agent penetration testing platform breakdown

1 reports1 reporting sourcesplus 1 outlets covering itLatest report

Start here

AI overview

On October 16, 2026, the WeChat public account Jumang Security Lab published a breakdown of the self-hosted multi-agent autonomous penetration testing platform vxcontrol/pentagi. In this platform, users describe targets in natural language, and the Orchestrator schedules specialized agents such as Researcher, Developer, and Executor, which invoke more than 20 security tools including nmap, Metasploit, and sqlmap inside an isolated Docker sandbox and output reports. The repository currently has 30,512 stars, 4,585 forks, and 33 open issues, uses the MIT license, and is developed in Go.

Generated by AI from reports · Updated 27 days ago

Latest update
PentAGI breakdown: a 30,000-star self-hosted multi-Agent penetration testing platform and sandbox testing of more than 20 security tools

Related research

Papers whose work the reports mention

Progress timeline

Oct 16
  1. WeChatDoonsec· Media coverage
    "AI penetration testing + autonomous Agent" PentAGI breakdown: 30,000-star self-hosted multi-Agent + 20 security tool sandbox hands-on test(opens the original post in a new tab)
  2. WeChat · Goumang Security Lab
    PentAGI breakdown: a 30,000-star self-hosted multi-Agent penetration testing platform and sandbox testing of more than 20 security tools

    vxcontrol/pentagi is a self-hosted multi-agent autonomous penetration testing platform. Users describe targets in natural language, and the Orchestrator schedules dedicated agents such as Researcher, Developer, and Executor, which call over 20 tools including nmap, Metasploit, and sqlmap inside an isolated Docker sandbox and produce reports. The repository currently has 30,512 stars, 4,585 forks, 33 open issues, uses the MIT license, is primarily written in Go, was created in January 2025, and the latest release is v2.2.0 (2026-10-05). The author is VXControl, a Dubai-based security engineering company. The article also provides configuration requirements for the sandbox and network boundaries, self-hosted installation steps and default passwords, docker.sock permissions, PROXY_URL scope, and a pitfall checklist including Graphiti being disabled by default.

Related discussion

Total 1 items