PentestGPT

PentestGPT is an AI agent for security testers working on authorized penetration tests and capture-the-flag (CTF) challenges. It can carry out a test autonomously or let you guide the work in an interactive mode.

• Autonomous testing: The agent uses Claude Code or Codex to run tools and reason through reconnaissance, exploitation and a walkthrough for CTFs, or asset discovery, vulnerability identification and a report for penetration tests.
• Interactive testing: The legacy mode lets you direct the session, discuss findings and track outstanding tasks while separate model sessions handle reasoning, generation and parsing.
• Challenge coverage: It handles web security, cryptography, reverse engineering, forensics, binary exploitation and privilege escalation challenges.
• Progress and saved sessions: Live activity updates show the agent's steps, and saved sessions let you resume unfinished tests.

The software is open source under the MIT license and runs locally as a Python application or in Docker. Autonomous testing requires an authenticated Claude Code or Codex account and connects to the corresponding cloud service. Local Ollama models are supported in interactive mode, which also works with OpenAI, Anthropic, Google Gemini, DeepSeek, xAI, Qwen and Moonshot through provider API keys.

Telemetry sends session metadata, tool-use patterns and flag-detection events to Langfuse, with an option to disable it. It excludes command outputs, credentials and flag contents.