Plain-AyI
← All projects
AI agents

PentestGPT

An AI agent that helps security testers find weaknesses in systems and solve hacking practice challenges.

Research-backed

What it does

Penetration testing (pentesting) means experts are given permission to try to break into a system so its weaknesses can be fixed before real attackers find them. PentestGPT uses AI to help with this work and with capture-the-flag (CTF) challenges, practice puzzles used to build security skills.

The agent works in stages: gathering information, finding and testing weaknesses, and writing up what it found. It can run on its own using Claude Code or Codex, or in an interactive mode where a person guides several AI sessions step by step. It covers areas like web security, cryptography, reverse engineering and forensics.

The project grew out of a research paper presented at the USENIX Security conference in 2024. The README says it is for education and authorised security testing only, and that it collects anonymous usage data, which you can switch off.

Who it's for

Security professionals, students and researchers doing authorised testing or CTF practice.

Can I use it without coding?

Developers only. Needs Python tools, a terminal and a signed-in Claude Code or Codex setup (or API keys); a Docker option is provided. New to this? Start here.

Can I run it?

Cost
Free, but needs an AI accountThe software is free, but it uses an online AI service (like OpenAI or Anthropic), which usually charges for use.
Computer
An ordinary computer is fine
Privacy
Sends what you give it to an online service
API key
Not needed

Try it

Using Claude Code, Cursor or another AI coding assistant? Paste the prompt and it will walk you through the setup.New to this?

Before you install

  • Only download from the official GitHub page. Copies with similar names exist for many popular projects.
  • License (MIT): Very permissive: free to use, change and share, including for business.
  • What you type or upload is sent to an online service. Avoid sharing private or sensitive information.
  • More on staying safe

Where people are talking about it