An Average Model, a Loaded Toolbelt
I spent a while running PentAGI, an autonomous AI agent for penetration testing. The capabilities are real. What stuck with me is where the only real safeguard actually lives, and how easily self-hosting removes it.
PentAGI is an open-source platform that turns a language model into an autonomous pentester. I deployed and tested one for a while, and I went in curious about the offense. I came out thinking about the model, and about how thin the line is between a useful tool and a dangerous one.
What PentAGI actually is
PentAGI is a self-hosted platform that wires a language model into a full offensive toolkit and lets it run. You give it a target and an objective, and a system of specialized agents plans the work, picks tools, executes them, reads the output, and decides what to do next, with as much or as little human oversight as you configure. It can run fully autonomously or in an assistant mode where a person approves each step.
Underneath, it is a multi-agent system. Different agents own different jobs: one researches and searches for vulnerabilities, one writes code and exploits, one executes commands, and others handle planning, memory, and reporting. A primary agent delegates between them. It is, in effect, a small automated red team with a model sitting at the center of every decision.
The capabilities that matter
The part that makes it more than a demo is how much real capability comes in the box:
- A suite of 20-plus professional security tools, the actual ones a pentester reaches for (nmap, Metasploit, sqlmap, and more), each executed inside isolated Docker containers.
- A headless browser and a stack of search backends (Tavily, DuckDuckGo, Google, Perplexity, Searxng, and vulnerability databases like Sploitus), so the agent researches targets and known exploits the way a human would.
- Long-term memory: a pgvector store plus a Neo4j knowledge graph, so the system remembers what worked, recalls it on the next engagement, and gets better over time.
- Operational guardrails: loop detection, task planning, and hard caps on tool calls, so a run terminates gracefully instead of spinning forever.
- And the important one: support for essentially any model backend, from hosted APIs to a local open-weights model served through Ollama, vLLM, or any OpenAI-compatible endpoint.
How it's wired
The shape is simpler than the component list suggests. A pentester hands PentAGI a task. The orchestrator reasons with the model, delegates to specialist agents, and runs tools inside a sandbox against the target. Everything it learns flows into memory, and the findings come back as a report.
Getting it onto Kubernetes
PentAGI ships as a Docker Compose stack, which is fine on a single host but not for a real deployment. So I wrote a Helm chart for the whole system and ran it on Kubernetes: the Go backend and React frontend, the Postgres and pgvector store, Neo4j, the sandboxed tool and scraper containers, and the observability stack, templated with sane defaults and the network segmentation the tool needs to keep testing traffic isolated from everything else. I've open-sourced the chart; it turns a single-host compose file into something repeatable, with the isolation a tool like this demands.
Where the safeguard actually lives
Here's the part that stuck with me: the only thing standing between this toolkit and real harm is the model's own refusal to cooperate. Point PentAGI at a hosted frontier model and ask for something plainly malicious, and a well-aligned model pushes back. That refusal is the safeguard. It isn't in the tool; the tool will happily run whatever it's handed. It's in the weights, and in the provider serving them.
Now swap the backend. PentAGI is designed to accept any OpenAI-compatible endpoint, so you can point it at an open-weights model running locally through Ollama or vLLM. Open weights can be stripped of their refusals with very little effort, by fine-tuning, by an abliteration pass, or sometimes by nothing more than a system prompt. Self-hosting also means no provider is in the loop to notice or say no. The safeguard is simply gone.
And the model doesn't need to be brilliant. The tools carry the capability. PentAGI already knows how to scan, enumerate, find a known exploit, and run it; it just needs something to make the calls. Pair a mediocre, unaligned local model with this platform and you've got a capable, tireless, autonomous attacker. That's the part I find genuinely worrying. The ceiling on offense is no longer the operator's skill, or even the model's intelligence. It's a toolkit anyone can download.
Where this leaves us
In the wrong hands, this plays out badly, and offense is commoditizing fast. Tools like PentAGI are genuinely useful for defenders, which is exactly why they exist, and I'm not arguing against them. I'm arguing that the durable control was never going to be in the tooling.
It has to sit at the model and provider layer: alignment that survives adversarial pressure, and providers willing to gate dangerous capabilities even when it costs them. That's the unglamorous, load-bearing work. The more of the offensive stack that gets automated and handed out for free, the more everything rests on the one safeguard that self-hosting can remove.