PentAGI

The model's tools run only inside a per-flow Docker container that is created with no environment variables, no cloud credentials and no Docker socket in the default configuration, so a hijacked agent does not hold API keys. Inside that container the agent is root with a broad capability set and unrestricted network egress. Operators are scoped by role privileges and every flow query is filtered by the owning user, but a seeded admin account ships with the documented password 'admin' (forced change on first login), and the shared vector store lets one user's agent read knowledge derived from other users' engagements.

There is no human approval step before any tool call. The terminal tool executes whatever shell string the model produces, and the system prompts tell the agents that every action is pre-authorized and needs no confirmation. The only interactive hook is an optional 'ask' tool (off by default) that the model itself decides to call. Attacks on target systems cannot be undone and nothing rate-limits them.

The terminal tool takes an arbitrary shell string and the browser tool takes any URL; the only validation is that file paths must not contain shell-expansion tokens. There is no target scope list or command filtering in code (scope is only described in prompts). Each agent receives a role-specific tool list and the model cannot add tools, but every working agent gets the shell by default and there is no operator switch to remove it. Commands are confined to the container, not to a target set.

Every model-reachable command, file operation and delegated agent action runs by Docker exec inside a per-flow container; no agent path uses host process execution, and if a container cannot be created the flow fails or falls back to the default image, never to the host. The container drops all capabilities and re-adds a 14-item list (Docker's default set minus MKNOD, plus SYS_PTRACE), has a 2048-process limit and mounts only its own work directory with no secrets in its environment. It is not hardened beyond that: root user, writable root filesystem, no no-new-privileges (deliberately omitted so privilege-escalation testing works), no memory or CPU limits, unrestricted egress, and ports published on all interfaces. Operators can opt in to Docker access inside the sandbox; a raw host-socket mount is documented as host-root equivalent and a TLS dind option with a startup isolation probe exists but both are off by default.

The agents read web search results, scraped pages, target responses and uploaded files, and all of it enters the model context with the same standing as instructions; the prompts contain no untrusted-content rules and no code distinguishes sources. A hijacked agent has an unrestricted shell with unrestricted egress and can attack other systems or move engagement data out unattended, with no human step. No secrets are placed in the sandbox, but findings, uploaded scope documents and discovered credentials are.

Tool results (terminal output, search results, file reads) and model-authored answers, guides and code snippets are written to a pgvector store automatically, with secret-pattern redaction but no validation, approval or expiry. Only the 'memory' type is filtered by flow; the answer, guide and code types live in one collection with no user or flow filter and are retrieved by later agents in other flows and for other users. Poisoned content from a web page or target can therefore persist and steer later engagements. Workspace files do not configure the agent.

There is no plugin or MCP loader, but by default the model chooses which Docker image the sandbox runs (any image reference, because the allowlist is empty), and the installer agent installs packages on the model's request. Defaults are unpinned (:latest and untagged pentest images) with no digest or signature check. All of it runs inside the sandbox container with an empty environment, which is what limits the damage.

Provider keys come from environment variables and are held by the orchestrator only; the sandbox environment is empty. A secret-pattern anonymizer redacts text before it is stored in the vector store or sent to external search engines, but terminal output goes to the model and the tool-call log unredacted and there is no log redaction. The default compose and env files are not locked down. A content-free update report is sent on a 3 hour timer by default; Langfuse and OpenTelemetry export are opt-in.

Every tool call from every agent is written to the database (name, arguments, result, status, duration, flow, task and subtask IDs) before the tool runs, and a failure to write stops the call. Terminal commands and output, messages and delegations between agents are also stored, and the log is written by the orchestrator, outside the sandbox. Records identify the flow and its owning user and the delegating agent role in separate tables, but the tool-call row itself carries no agent or user field and there are no approvals to record. Export to Langfuse or OpenTelemetry exists but is opt-in.

Each agent chain stops after 100 (main agents) or 20 (helper agents) model turns, repeated identical tool calls are cut off, and each shell command has a timeout (20 minutes by default, 3 hours maximum). Stopping a flow kills the commands it started inside the sandbox. There is no token, cost or wall-clock limit for a flow, and delegated agents start their own iteration budgets, so total work is bounded only by the tool graph and the operator's provider spend limits.