PentestGPT
An autonomous penetration-testing agent that drives Claude Code or Codex through staged reconnaissance, exploitation and reporting phases for security assessments and capture-the-flag challenges.
PentestGPT is an autonomous penetration-testing agent, published at USENIX Security 2024, that works through staged phases: reconnaissance, exploitation and walkthrough for capture-the-flag challenges, or asset discovery, vulnerability identification and reporting for penetration tests, feeding each stage's findings into the next.
Its agentic mode drives Claude Code or Codex to run tools and reason through a challenge without human intervention, and can save and resume a testing session. An older interactive mode supports a wider range of model providers, including OpenAI, Anthropic, Google Gemini, DeepSeek, xAI, Qwen, Moonshot and local Ollama models.
It covers multiple challenge categories, including web, cryptography, reverse engineering, forensics, binary exploitation and privilege escalation, and tracks an agent's steps in real time as it works. It is written in Python and released under the MIT license.