Pentest Swarm AI is an open-source framework that performs autonomous penetration testing with a swarm of specialized AI agents. Built in Go by Armur AI, it orchestrates reconnaissance, classification, exploitation and reporting agents that reason in ReAct loops and share findings, working through an authorized target the way a small red team would. The project has about 3,000 stars on GitHub and is under active development in 2026.
Instead of a single model improvising shell commands, the swarm divides labor: recon agents map hosts, ports and services; classifiers prioritize the attack surface; exploitation specialists attempt validated attack paths with more than seven native security tools integrated; and reporting agents compile evidence into findings. Modes cover one-off bug bounty engagements, continuous monitoring of an organization’s assets, and CTF challenges. Operators define scope and rules of engagement up front, and the agents’ step-by-step reasoning is logged so a human can audit every action the swarm took โ important for a tool whose whole job is attacking systems you own or are authorized to test. Being written in Go, it ships as a fast native tool that fits into security automation pipelines and CI-style scheduled assessments.
Pentest Swarm AI is free and open source under the AGPL-3.0 license. You bring your own model API keys and, of course, targets you are authorized to test.
Pentest Swarm AI is for security professionals, bug bounty hunters and red teams who want AI agents to automate the repetitive stages of penetration testing under explicit scope and human oversight.