Authorised testing only. PentestGPT is a penetration testing tool. Use it exclusively against systems you own or for which you hold explicit written authorisation. Testing third-party infrastructure without permission is a criminal offence in most jurisdictions. This review is published for security professionals, students and CTF players working within those boundaries.
What is PentestGPT?
PentestGPT is an open-source agentic framework that uses large language models to guide a penetration test. It was created by GreyDGL, a PhD researcher at Nanyang Technological University in Singapore, and published at USENIX Security 2024 — it is one of the first academically documented attempts at an LLM agent framework built specifically for offensive security.
It is not a "hack everything" button. It behaves closer to an experienced colleague looking over your shoulder — it decides what to try next, writes the exact command, reads the output, and updates its plan.
Final score — 3.8 / 5
How the three modules work
PentestGPT runs three cooperating LLM sessions rather than one, which is the design decision that makes it work at all — a single context window degrades badly across a long test.
- Reasoning — acts as the team lead. Maintains a dynamic Pentesting Task Tree (PTT) and decides overall strategy.
- Generation — produces the exact commands and payloads to run (
nmap,gobuster,sqlmapand similar). - Parsing — digests terminal output, logs, HTTP responses and web content, and feeds the relevant details back to reasoning.
You drive the session interactively with a small set of commands — next, more, todo, discuss — which keeps a human in the loop at every decision point rather than letting the agent run unattended.
Guided mode as a teaching tool
Its most defensible use is as a mentor. It walks a junior tester through a CTF environment or a network review while explaining why it is choosing a given attack vector. That explanation layer is genuinely useful for learning, and it is the use case where hallucination costs the least.
Reporting
It structures findings, logs the commands actually executed, and generates Markdown reports with severity ratings, proof-of-concept steps and remediation notes.
What it costs to run
The framework is free and open source. The real cost is model tokens.
The original release depended on GPT-4 and therefore required a ChatGPT Plus subscription. The modernised interactive legacy mode (pentestgpt-legacy) supports a much wider provider set — OpenAI, Anthropic, Google Gemini, DeepSeek, xAI, Qwen, Moonshot, and local models via Ollama.
That last option matters more than it looks. Running PentestGPT against a local model removes the API bill entirely and, more importantly, keeps target data off third-party infrastructure — which for authorised engagements under NDA is often not optional.
Pros and cons
Pros
- Genuinely good reasoning structure across multi-stage work, from reconnaissance through to exploitation planning.
- Free, open source and self-hostable, so sensitive target data need never leave your environment.
- Strong learning tool — the explanation of each chosen vector is valuable for junior engineers and CTF players.
- Broad model support in legacy mode, including fully local inference through Ollama.
Cons
- Hallucinates on obfuscated or heavily customised payloads. In offensive security a confident wrong answer costs more than no answer, and this is where the tool is weakest.
- Reasoning quality tracks model quality directly. On a cheap or small model the task tree degrades into generic advice, so the "free" framing is misleading in practice.
- Command-line workflow assumes you already know pentesting. It is not an entry point to the field; it accelerates someone who could do the work anyway.
- Maintained essentially by one author. It is a research project with an excellent paper behind it, not a commercially supported product with a support SLA.
Verdict
PentestGPT is the most credible open-source demonstration of agentic AI applied to security testing, and the USENIX paper behind it gives it a rigour most tools in this space lack.
It earns its place as a reconnaissance accelerator and a teaching tool, not as an autonomous tester. Used by someone who can already recognise when the model is wrong, it removes a lot of repetitive typing and occasionally suggests a vector worth trying. Used by someone who cannot, it will confidently lead them down a dead end.
If you need vulnerability scanning inside a development workflow rather than adversarial testing, Snyk and GitGuardian solve a different and better-defined problem.
Framework details verified against the project repository and the USENIX Security 2024 paper on 4 August 2026.