# Autonomous penetration testing

> What autonomous penetration testing is, how PentAGI carries a test from a goal to a report, and where people stay in control.

In an autonomous penetration test, an AI system plans and carries out the steps of the test itself. It decides what to look at next from what it has found so far, runs the [tools](https://pentagi.com/docs/glossary/#tool), checks the results and writes up what it learned. A scanner runs the same checks every time; an autonomous [agent](https://pentagi.com/docs/glossary/#agent) changes its plan as the test goes on.

## [How PentAGI runs a test](https://pentagi.com/docs/concepts/autonomous-pentesting/#how-pentagi-runs-a-test)

You describe a target and a goal in plain language: what to assess, what is in scope and what counts as done. From there a [flow](https://pentagi.com/docs/getting-started/first-flow/) runs on its own:

1. Your message becomes a [task](https://pentagi.com/docs/glossary/#task), and the generator splits it into up to 15 [subtasks](https://pentagi.com/docs/glossary/#subtask).
2. For each subtask, the primary agent hands the work to specialists — the searcher, pentester, coder or installer — who act through their tools.
3. The tools run in the [flow](https://pentagi.com/docs/glossary/#flow)'s own [sandbox](https://pentagi.com/docs/glossary/#sandbox) container, built from an image picked for the goal, not inside PentAGI itself; a [worker node](https://pentagi.com/docs/deployment/worker-node/) keeps them off the PentAGI host altogether.
4. After each subtask, the refiner reviews the remaining plan and changes it when the results call for it.
5. When the task is done, the reporter writes up its result, and the flow's [report](https://pentagi.com/docs/glossary/#report) collects the results of all its tasks.

Commands, their output and the results stay in the flow's [memory](https://pentagi.com/docs/concepts/memory/), so later subtasks build on earlier ones; the guides, answers and code the agents save there serve later flows as well.

## [Where you stay in control](https://pentagi.com/docs/concepts/autonomous-pentesting/#where-you-stay-in-control)

* **Scope.** The agents follow the task: write the targets, the boundaries and any rules of [engagement](https://pentagi.com/docs/glossary/#engagement) into it. PentAGI does not restrict targets on its own, so enforce a hard boundary at the network level, for example with firewall rules on the [worker node](https://pentagi.com/docs/glossary/#worker-node).
* **Interactive mode.** In **Assistant** mode you work through the test step by step with an agent instead of letting it run on its own.
* **Steering.** The **Assistant** view of a running flow lets you check its state, stop the current task, send follow-up instructions or change the planned subtasks — see [Steer a running flow](https://pentagi.com/docs/getting-started/first-flow/#steer-a-running-flow).
* **Questions.** With `ASK_USER=true`, the primary agent can pause the flow and ask you for input. It is off by default.
* **Limits.** [Tool call](https://pentagi.com/docs/glossary/#tool-call) limits and repeat detection stop an agent that goes in circles, and the reflector brings back one that stops calling tools — see [Safeguards](https://pentagi.com/docs/concepts/agents/#safeguards).

## [When it fits](https://pentagi.com/docs/concepts/autonomous-pentesting/#when-it-fits)

Autonomous testing suits repeated assessments of your own systems, lab and training targets, and the first pass of an engagement: mapping the attack surface, checking known weaknesses and writing up what was found. It does not replace a tester's judgment on scope, impact and risk, and two runs of the same task can differ, so treat its [findings](https://pentagi.com/docs/glossary/#finding) as leads to confirm.

> [!WARNING]
> Only test systems you own or are explicitly authorized to assess. Use of PentAGI is subject to the [EULA](https://github.com/vxcontrol/pentagi/blob/main/EULA.md).