Open-source agent
SwarmAttacker vs PentestGPT
The best-known academic open-source pentesting agent, from USENIX Security 2024, now an autonomous pipeline that drives Claude Code or Codex against a target host.
- Vendor
- GreyDGL (Gelei Deng, NTU)
- Licence
- MIT
- Pricing
- Free. You pay for the LLM through Claude Code or Codex logins, or provider API keys.
- Checked
- September 2, 2026
| Capability |  SwarmAttacker8 of 8 | PentestGPT3 of 8 |
|---|---|---|
| Free | Yes. | |
| Runs on a ChatGPT subscription | Partial. | |
| Custom prompts & skills | Not found. | |
| Safety-refusal handling | Not found. | |
| Parallel multi-agent swarm | Not found. | |
| MIT-licensed open source | Yes. | |
| Black-box from a URL | Partial. | |
| Model-agnostic | Yes. |
- yes
- not found or only partly
Hover a mark for the evidence. A cross means the capability was not found, or only partly found, on PentestGPT's public pages or repository on September 2, 2026, not that it is technically impossible.
Profile
What is PentestGPT?
PentestGPT is an MIT-licensed, academically maintained LLM pentesting agent by Gelei Deng at Nanyang Technological University, first published at USENIX Security 2024. The original design was an interactive assistant: three cooperating LLM sessions kept a task tree while a human ran every command. Release 1.0.0 in December 2025 replaced this with an autonomous pipeline that drives the Claude Code or Codex command-line tools against a target host. The public runtime is deliberately sequential, one task per cycle with no parallel scheduler, has no user-skill or refusal-handling mechanism beyond a free-text instruction flag, and is essentially single-maintainer with around 15,000 stars.
A separate research design, called PentestGPT v2 or "Excalibur", was published in February 2026 with typed tools, retrieval-augmented documentation and evidence-guided attack-tree search. Its code was released only through an anonymous review repository that has since expired, so the design has no public, runnable code.
Because the autonomous agent delegates to the Claude Code and Codex tools, it can run on a ChatGPT-account Codex login, but that path is provided by the external tool rather than built in. It targets hosts and networks rather than web URLs, and sends anonymous telemetry by default.
In SwarmAttacker's favour
Where it stands out.
- 01A parallel swarm versus a single sequential loop. SwarmAttacker fans out recon and executor agents at once; PentestGPT's own architecture doc rules out a parallel scheduler.
- 02Refusals are handled, where PentestGPT has no refusal handling at all in its code or papers.
- 03User-injectable attack skills, versus PentestGPT's single free-text instruction flag.
- 04The ChatGPT-subscription backend is built in, rather than delegated to an external command-line tool.
In PentestGPT's favour
Where it is stronger.
- 01A peer-reviewed USENIX Security paper and by far the most recognised name in the field, with around 15,000 stars.
- 02Host and network scope, including HackTheBox, VulnHub and Active Directory scenarios, beyond web apps.
- 03A large legacy interactive mode supporting many providers and local models.
Verdict
Which one should you pick?
Pick PentestGPT if you want the best-known name, a peer-reviewed pedigree and host or network scope. Pick SwarmAttacker if you want a parallel black-box web swarm with refusal handling and user skills.
Sources
What this page was checked against.
All checked on September 2, 2026.
Turn a URL into a security report.
Open source, MIT licensed, and it runs on the ChatGPT plan you already pay for. Install it and point it at a target you own.
brew install joloooo/swarm/swarm