PentestGPT

PentestGPT is an open-source (MIT-licensed) AI agent that assists with penetration testing and Capture-the-Flag challenges, powered by large language models. It was created by Gelei Deng; the method was described in a paper presented at the 33rd USENIX Security Symposium in 2024.

Version 1.0 introduced an agentic mode: a multi-stage pipeline (recon → exploit → walkthrough for CTF; asset discovery → vulnerability identification → report for pentests) in which the agent autonomously drives the Claude Code or Codex tools, with session save and resume.

The classic interactive mode from the USENIX 2024 paper is preserved and modernized as pentestgpt-legacy: three cooperating LLM sessions — reasoning, generation and parsing — maintaining a Pentesting Task Tree (PTT) under human control. This mode talks natively to many model providers: OpenAI, Anthropic, Google Gemini, DeepSeek, xAI, Qwen, Moonshot and local models via Ollama.

The tool itself is free; costs come from using your own API keys for the chosen models (or running locally via Ollama). It collects anonymous usage telemetry (Langfuse) with an opt-out. The research was supported by Quantstamp and NTU Singapore. Intended solely for authorized security testing.