PentestGPT

Why we included this project

Security teams and penetration testers curious about how far LLM-driven agents can go in offensive security will find this a useful reference. PentestGPT turns a large language model into a multi-stage agent that carries a session from reconnaissance through exploitation to reporting, and it can run either autonomously on Claude Code or Codex or interactively with a human in the loop across many providers. The interactive mode is the more practical option for most practitioners: it maintains a task tree and a reasoning loop that generates and parses each step, so you can steer the session step by step instead of trusting the model end to end. It also covers a broad range of challenge categories, from web and crypto to reversing, forensics, and privilege escalation, which makes it useful for real engagements and CTF practice alike. The design is documented in a USENIX Security 2024 paper, so the decisions behind it are explained rather than just asserted.