SwarmAttacker vs PentAGI

PentAGI is a fully autonomous, self-hosted AI pentesting system from VXControl, a security studio in Dubai. Its source is MIT-licensed, shipped with an additional acceptable-use EULA. The stack is a Go backend, a React web UI, PostgreSQL with vector search, an optional knowledge graph, and a full observability suite, with all offensive work running inside a Kali-based Docker sandbox holding many built-in tools.

A user submits a natural-language target and goal through the web UI. A primary agent decomposes the engagement into tasks and subtasks and delegates to 13 role-specialised agents such as pentester, coder, searcher and reporter. Within a single engagement, subtasks execute sequentially, one at a time with refinement after each; parallelism applies across separate engagements rather than among agents in one run. It supports more than ten LLM providers, selected per agent, but authentication is by API key or self-hosted endpoint only, with no ChatGPT-subscription login. Safety is handled by a static, pre-authorized prompt block rather than active refusal recovery, and the README warns that recent OpenAI models may trigger cyber-safety mechanisms.

The project is very active, with around 22,000 stars and releases through 2026. Independent reviewers praise its architecture and persistent memory but repeatedly flag a long and complex Docker-Compose setup, false positives, and that it augments rather than replaces human testers. Third-party runs on various targets report figures from 45% to roughly 75% depending on the model and suite.