PentAGI Tutorial — Getting Started with Autonomous AI Pen Testing in Docker

🛠️ PentAGI Tutorial — From Zero to Autonomous Pentesting in 10 Minutes

So you want to see PentAGI in action. Good call. I'll walk you through exactly how I set it up — including the stupid mistakes I made so you don't repeat them. This takes about 10 minutes, plus a coffee break while the agents do their thing.

📋 Prerequisites

Before we start, make sure you have:

• Docker installed (24+ recommended)
• 4GB+ RAM available (I tried 2GB — it was painful. Don't.)
• An OpenAI or Anthropic API key (the agents need a brain)
• A target to test — use a lab VM, don't point this at production!

Step 1: Pull and Run PentAGI

This is the easy part. One command, and you're off:

docker pull vxcontrol/pentagi:latest
docker run -d \
  --name pentagi \
  -p 8080:8080 \
  -v pentagi_data:/data \
  -e OPENAI_API_KEY=sk-your-key-here \
  vxcontrol/pentagi:latest

Step 2: Access the Dashboard

Open your browser and go to http://localhost:8080. You should see the PentAGI dashboard — a clean React UI showing your agent fleet. If you see a blank page:

• Wait 30 seconds (Go binary needs a moment to compile the GraphQL schema on first run)
• Check docker logs pentagi for errors
• Make sure port 8080 isn't taken by something else (I had an old Grafana container hogging it)

Step 3: Configure Your First Target

In the dashboard, you'll find a "New Session" button. Click it, and you'll see:

1. Target input — IP range or domain (I used 10.0.0.0/24 for my lab)
2. Model selection — Pick GPT-4 or Claude 3.5 (or both — the orchestrator distributes tasks)
3. Scan profile — Full, Quick, or Stealth (I started with Quick for testing)
4. Agent selection — Which agents to include (default: all five)

Step 4: Watch the Magic (Real-Time)

Hit "Start" and watch the dashboard come alive. The GraphQL subscriptions push updates in real-time — you'll see the Recon Agent discover hosts, the Scanner Agent queue up checks, and the Exploit Agent patiently waiting for something juicy.

Pro tip: Open the network tab in your browser dev tools. The GraphQL subscription messages are fascinating — you can see exactly what data each agent is passing to the next. It's like reading their group chat.

Step 5: Read the Report

When the session finishes (or whenever you want to check progress), head to the Reports tab. The Report Agent auto-generates a findings document with:

• 📋 Executive summary (for your boss)
• 🔍 Technical findings with CVSS scores
• 📸 Evidence (command outputs, screenshots of exploits)
• 🛡️ Remediation steps with priority levels

I exported one as PDF and sent it to my CTO. He asked if I'd hired a consultant. Nope — just a container full of angry AI agents.

🐛 Common Gotchas (From My Pain)

🎬 What Does This Look Like in Action?

PentAGI doesn't have public screenshots in the repo — it's a young project and the team's focused on the code. But here's what you'll actually see:

• Dashboard: Clean React UI with a side panel showing active agents, a main area with real-time logs, and a top bar with session controls.
• Agent Activity: Each agent has a status indicator (idle/working/error) and you can click to expand their current task details.
• GraphQL Explorer: Built-in playground at /graphql for custom queries if you want to dig deeper.

Think of it like watching a security operations center dashboard — but instead of humans, it's AI agents, and instead of monitoring, it's actively attacking.

🚀 Next Steps

Once you've run a basic scan, try these:

1. Full profile on a vulnerable VM (Metasploitable, DVWA, HackTheBox)
2. Schedule recurring scans with cron + Docker restart policies
3. Custom agents — the Go codebase is modular, you can add specialized agents
4. Integrate with Slack/Teams for notifications when critical vulns are found