PentestGPT: Open-source automated penetration testing agentic framework

1. Executive summary

PentestGPT is an open-source, LLM-driven automated penetration testing framework that autonomously executes recon, exploitation, and reporting against a target with no human in the loop. The agent drives Claude Code or Codex CLIs to run tools and decide attack paths, and transmits session telemetry (target type, duration, tool usage, flag discovery) to a third-party Langfuse project by default. EMEA financial services clients must be aware of two distinct risk vectors: the operational risk of autonomous offensive tools running against production infrastructure without real-time human judgement, and the data-governance risk of session metadata leaking to a third-party SaaS telemetry provider during security testing.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item.

3. Technical analysis & attack chain

PentestGPT is a dual-mode agentic framework that maps a large language model to offensive security tooling. The original version was published at USENIX Security 2024 by Gelei Deng and colleagues.

Architecture and autonomous attack chain

Initialisation: The operator installs Python 3.12+, the uv package manager, and authenticates the Claude Code or Codex command-line tools. The Docker image bundles both CLIs; tokens persist in volumes and survive container recreation. Codex login cannot be pre-seeded because ChatGPT refresh tokens are single-use — the OAuth callback is forwarded through socat instead.
Default mode (autonomous): The agent executes a sequential pipeline: recon → exploit → walkthrough. Each stage feeds the next automatically. No human sits in the loop. The LLM reasons about tool output and decides the next action.
Pentest mode (autonomous): The pipeline stages become asset discovery → vulnerability identification → report.
Legacy mode (pentestgpt-legacy): A human-in-the-loop, interactive design running three cooperating LLM sessions (reasoning, generating, parsing) that maintain a Pentesting Task Tree. This mode supports more providers: OpenAI, Anthropic, Google Gemini, DeepSeek, xAI, Qwen, Moonshot, and local models via Ollama. The model registry was web-verified in June 2026, acknowledging that model IDs go stale. A built-in smoke test live-round-trips every configured model and prints a pass/fail matrix.

Telemetry and data exposure

By default, PentestGPT sends anonymous usage data to a Langfuse project. The transmitted data includes session metadata (target type, duration, completion status), which tools ran, and whether a flag was found. The source states that command outputs, credentials, and flag values are never transmitted. Opting out requires a command-line flag or an environment variable.

Confidence caveat: This advisory is single-sourced (Help Net Security). The technical claims regarding telemetry scope and autonomous behaviour are based solely on that publication; verify against the primary GitHub repository before enforcement.

4. Mitigation & containment

P1 — Within 24h (if PentestGPT is detected in your environment)

Isolate any host running PentestGPT from production networks immediately. An autonomous agent executing exploitation without human judgement poses an uncontrolled operational risk.
Block outbound traffic from testing environments to Langfuse endpoints at the egress firewall/proxy to prevent unauthorised telemetry exfiltration of session metadata.
Review whether any security testing vendor or internal red team has deployed this tool against client or production infrastructure without disclosure.

P2 — Within 72h

If the tool is sanctioned for internal use, enforce the telemetry opt-out via environment variable across all Docker images and execution environments. Do not rely on operator compliance.
Restrict the tool's execution to isolated, ephemeral testing environments with no route to production infrastructure or sensitive data stores.
Require explicit change management approval before any autonomous offensive tool is pointed at client-facing or production systems.

P3 — Within 7 days

Update security testing and red team engagement policies to explicitly govern the use of autonomous LLM-driven offensive tools, including mandatory human-in-the-loop requirements for exploitation stages.
If the legacy mode is used, run the built-in smoke test against all configured model providers before operational use to confirm model ID validity.
Review third-party data processing implications of any telemetry sent to Langfuse or other SaaS endpoints during security testing, particularly where client engagement contracts restrict data sharing.

5. Indicators of compromise

No indicators of compromise available in the source material.

Behavioural indicators

Behaviour	Where to observe	Confidence
Autonomous execution of recon and exploitation tools without human interaction	EDR process trees, SIEM session correlation — rapid sequential tool execution from a single host with no interactive login patterns	Medium — single-sourced
Outbound connections to Langfuse telemetry endpoints	Egress firewall/proxy logs, network flow data	Medium — single-sourced
OAuth callback forwarding via `socat` (Codex authentication setup)	Host process monitoring, network connections on non-standard ports	Medium — single-sourced
Execution of `uv` package manager pulling PentestGPT dependencies	Endpoint logging, package manager telemetry	Low — single-sourced

6. Detection

Insufficient indicators to author detection rules.

7. Sources

Help Net Security, "PentestGPT: Open-source automated penetration testing agentic framework", https://www.helpnetsecurity.com/2026/08/12/pentestgpt-open-source/, 2026-08-12

8. Adverse Trace position

PentestGPT is not a threat actor or vulnerability — it is a capability tool that lowers the barrier to autonomous offensive security operations. The risk to EMEA financial services is twofold: uncontrolled autonomous exploitation against production systems, and default telemetry exfiltration of testing session metadata to a third-party SaaS provider (Langfuse). The source is single-sourced; we assess the telemetry and architecture claims as plausible but uncorroborated. We will monitor the GitHub repository for changes to telemetry defaults, additional provider integrations, and any reported misuse or weaponisation by threat actors. Clients should treat any unsanctioned deployment of this tool as a policy violation and assess sanctioned deployments against their third-party data processing and operational risk frameworks.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.