Known malicious kitlowother
PentAGI consoles reachable from the internet
family: pentagi-console-2026-11
Short link:scanmalware.com/h/339
Tracks internet-reachable consoles of PentAGI, an open-source system in which AI agents plan and carry out penetration-testing tasks on their own. Threat researchers list it among the AI pentest harnesses exposed on the internet, next to Cairn and ARTEX. Matches the default certificate the console generates, the project's favicon and its title. A match identifies the software, not how it is used: the project is also used for authorized testing.
Anchors
SMQL queryrun
cert_issuer:"PentAGI CA" OR favicon_hash:1567951828 OR title:"PentAGI"Provenance
Added: 2026-11-02 19:07
The console usually listens on port 8443 with a self-signed certificate whose issuer is PentAGI CA, and shows a sign-in page. Renamed builds such as xhackai keep that certificate and favicon. A build that replaces both and changes the title is not covered. A page that only copies the name or favicon is not a console, so check for the sign-in page and the certificate. Confirm unauthorized use before treating a sighting as hostile.