PentestAgent is an open-source AI agent framework for black-box security testing, built to support bug bounty hunting, red-team exercises and penetration testing workflows. The project is developed by GH05TCREW on GitHub, where it has earned roughly 3,200 stars, and it remains under active development in 2026. Instead of a single chatbot prompt, PentestAgent structures an engagement the way a human tester would: reconnaissance, enumeration, hypothesis-driven testing and documented findings.
The framework runs autonomous and crew-style multi-agent modes in which specialised agents share context through a knowledge graph and a persistent notes system. Findings are saved to structured loot files with categories such as credential, vulnerability, finding and artifact, and they persist across sessions so later runs can build on earlier evidence. MCP tool integration lets the agents call external security tools, while a “shadow graph” in crew mode tracks relationships between discovered assets and issues.
The workflow mirrors a real engagement: agents enumerate the target, record every observation into the shared knowledge store, form hypotheses about weaknesses, and then test them with tools rather than guessing. This evidence-driven loop, with findings categorised and persisted in loot files, is meant to reduce the hallucinated vulnerabilities that plague naive LLM pentesting setups, and to leave an auditable trail a human tester can review. The maintainers position the framework for authorised security work such as CTF competitions, lab environments and sanctioned bug bounty programmes.
PentestAgent is free and open source under the MIT license. You supply your own LLM API keys and run it against systems you are authorised to test.
Security researchers, bug bounty hunters and red teamers who want an agentic assistant to automate the repetitive parts of black-box testing.