Autonomous penetration testing

In an autonomous penetration test, an AI system plans and carries out the steps of the test itself. It decides what to look at next from what it has found so far, runs the tools, checks the results and writes up what it learned. A scanner runs the same checks every time; an autonomous agent changes its plan as the test goes on.

How PentAGI runs a test

You describe a target and a goal in plain language: what to assess, what is in scope and what counts as done. From there a flow runs on its own:

1. Your message becomes a task, and the generator splits it into up to 15 subtasks.
2. For each subtask, the primary agent hands the work to specialists — the searcher, pentester, coder or installer — who act through their tools.
3. The tools run in the flow's own sandbox container, built from an image picked for the goal, not inside PentAGI itself; a worker node keeps them off the PentAGI host altogether.
4. After each subtask, the refiner reviews the remaining plan and changes it when the results call for it.
5. When the task is done, the reporter writes up its result, and the flow's report collects the results of all its tasks.

Commands, their output and the results stay in the flow's memory, so later subtasks build on earlier ones; the guides, answers and code the agents save there serve later flows as well.

Where you stay in control

• Scope. The agents follow the task: write the targets, the boundaries and any rules of engagement into it. PentAGI does not restrict targets on its own, so enforce a hard boundary at the network level, for example with firewall rules on the worker node.
• Interactive mode. In Assistant mode you work through the test step by step with an agent instead of letting it run on its own.
• Steering. The Assistant view of a running flow lets you check its state, stop the current task, send follow-up instructions or change the planned subtasks — see Steer a running flow.
• Questions. With ASK_USER=true, the primary agent can pause the flow and ask you for input. It is off by default.
• Limits. Tool call limits and repeat detection stop an agent that goes in circles, and the reflector brings back one that stops calling tools — see Safeguards.

When it fits

Autonomous testing suits repeated assessments of your own systems, lab and training targets, and the first pass of an engagement: mapping the attack surface, checking known weaknesses and writing up what was found. It does not replace a tester's judgment on scope, impact and risk, and two runs of the same task can differ, so treat its findings as leads to confirm.