Writeup
PentAGI 2.0: An Honest Look at an Autonomous AI Pentesting Orchestrator
Source: PentAGI 2.0: обзор автономного ИИ-агента для пентестов — SecurityLab (securitylab.ru), original language: Russian. Translated & adapted by Sourav Banerjee.
Original URL: https://www.securitylab.ru/blog/personal/Bitshield/360869.php
PentAGI is an open platform from VXControl for automating security testing. The user sets a target, and the system distributes work among AI agents, runs pentest tools in containers, and assembles a report. The project describes itself as a "fully autonomous agent" — but it's more accurate to call it an orchestrator of language models, Docker, and tools like nmap, Metasploit, and sqlmap.
The current release reviewed is PentAGI 2.0.0 (April 11, 2026). Version 2.0 added DeepSeek, GLM, Kimi, and Qwen providers, cost analytics, mid-task model switching, and agent supervision. These capabilities are genuinely useful in a lab or for internal audits — but they don't make the model an expert you'd safely hand a production network.
This material is intended for legal and responsible use. Test only your own stands or systems you have written permission to test.
How PentAGI works
Work begins with a flow — a top-level task. The orchestrator breaks down the goal and connects specialized agents:
- Researcher — gathers information about the target and known problems
- Developer — plans the checks
- Executor — runs commands
Tool output and notes are stored in PostgreSQL with pgvector, so the system can find similar observations in future runs. An optional Graphiti module builds a knowledge graph in Neo4j linking targets, tools, vulnerabilities, and actions. For observability: Langfuse, OpenTelemetry, Grafana, VictoriaMetrics, Jaeger, and Loki. REST and GraphQL APIs let you embed the platform into internal audits — though automatically launching active checks without manual approval sharply raises the cost of a mistake.
| Component | Benefit | Risk |
|---|---|---|
| AI agents | Plan steps | Erroneous actions |
| Containers | Run tools | Docker + network access |
| Memory | Store results | Secret leakage |
| Logs | Help investigate failures | Sensitive output |
Deployment: where the risks start
Documentation lists a minimum of Docker Compose or Podman, 2 vCPU, 4 GB RAM, and 20 GB disk. After configuring .env, the base stack starts with docker compose up -d, and the UI opens at localhost:8443. You need at least one model provider: a cloud API or local Ollama.
Never leave the first run with default settings. The default login is admin@pentagi.com / admin, and the config requires replacing the cookie salt and database passwords. The service listens on 127.0.0.1 by default — publishing it externally without a certificate, access controls, and a firewall is dangerous.
The main container accesses docker.sock and, per the docs, runs as root because it creates worker containers. Access to the Docker API is roughly equivalent to admin rights on the host. For sensitive environments, developers recommend a two-node setup where executors run on a separate server — a far sounder option than running autonomous commands next to corporate secrets.
Where it helps vs. where marketing outruns reality
PentAGI fits where the target is authorized and constrained: a training stand, CTF, an isolated app clone, or re-verification of a known attack surface. The agent can quickly consolidate tool output, preserve the check progress, and draft a report. A specialist still must confirm the findings.
The honest framing matters: "fully autonomous agent" is the marketing line. What you actually get is a capable orchestrator that still needs human judgment to stay safe and accurate.
Takeaway
PentAGI 2.0 is a practical example of the current state of AI-pentest tooling: genuinely useful for scoped, authorized work, with real orchestration and memory benefits — but with deployment risks (root Docker access, default credentials, secret leakage) that demand careful isolation. The default-credentials and docker.sock exposure points are exactly the kind of thing that turns a pentest tool into a liability if left unhardened.