PentestMCP is a multi-agent framework that uses large language models to autonomously conduct penetration testing, demonstrated with GPT-5.2, achieving high success rates across information gathering (87.2%), vulnerability discovery (74.0%), and exploitation (64.9%) over 100 real-world vulnerabilities.

The study flags dual-use concerns, including prompt injection risks and alignment challenges, and notes that the OWASP Top 10 for LLM applications spotlight these threats, emphasizing ongoing research to keep autonomous agents within authorized boundaries while balancing offensive and defensive cybersecurity dynamics.

Technical details include a MongoDB-backed knowledge base, sentence-transformer embeddings (all-MiniLM-L6-v2) with cosine similarity, topological sorting for task graph ordering, and retrieval-augmented generation combined with generative exploration to reduce hallucinations and boost robustness.

The framework seeks to address the human bottleneck in pentesting by orchestrating the entire offensive security workflow—from reconnaissance to exploitation—through language models and external security tools.

PentestMCP rests on three core mechanisms: a Model Context Protocol for standardized tool invocation (e.g., Nmap, Sqlmap, Metasploit), a dynamic closed-loop Pentesting Task Graph that decomposes and updates tasks as new information arrives, and a dual-path exploitation policy that balances knowledge retrieval from exploit databases with generative reasoning to craft novel payloads and feed successful exploits back into the knowledge base.

Overall, automated AI-driven offensive security is becoming measurable and potentially disruptive, signaling a growing arms race in AI-powered cybersecurity and raising implications for democratized defensive testing.

Source: Zhai, J., Zhou, X., Miao, H., Li, Z., Li, Z., & Yang, H. (2026). PentestMCP: LLM and MCP based multi-agent framework for automated penetration testing. Cluster Computing, 29(15), Article 854.

The evaluation covered over 100 real-world vulnerabilities across diverse CWE categories, with PentestMCP outperforming baselines such as PentestGPT, Vulnbot, and PentestAgent in accuracy, speed, and overall efficiency across reconnaissance, discovery, and exploitation.