PentAGI vs XBOW
PentAGI (VXControl) and XBOW (XBOW) side by side on public data, as of Oct 6, 2026.
PentAGI shipped 1 stable releases in the past 90 days.
Side-by-side numbers
| Metric | PentAGI | XBOW |
|---|---|---|
| Pulse Score | 30 | 11 |
| Overall rank | #133 | #209 |
| Downloads, last 7 days | — | — |
| Downloads, 7-day change | — | — |
| Downloads, 30-day change | — | — |
| VS Code installs | — | — |
| Marketplace rating | — | — |
| GitHub stars | 25.3K | — |
| Homebrew installs, 30 days | — | — |
| Hacker News mentions, 30 days | 0 | 1 |
| Latest stable release | 2.2.0 · yesterday | — |
| Stable releases, 90 days | 1 | |
| Terminal-Bench (best run) | — | — |
| Price | Free (OSS) | Usage-based |
| License | MIT | |
| First released | January 2025 | July 2024 |
| Interfaces | — | — |
| Models |
Trends
PentAGI
A self-hosted multi-agent system that carries out penetration testing tasks in a sandboxed environment, written in Go and React and working with several model providers.
Pricing: Free and open source (MIT), self-hosted; users pay their own model costs.
Latest release 2.2.0:
- Reasoning the way each vendor expects it — adaptive thinking, effort levels, thinking budgets, and a real "off" are sent in each model family's native form. Combinations a vendor would reject are…
- Three new providers — MiniMax, Mistral, and xAI, for 13 provider types in total. Any other OpenAI-compatible endpoint works through the custom provider, which now also calls Azure OpenAI…
- Tested, not just listed — every built-in provider, plus example configurations for OpenRouter, DeepInfra, Ollama Cloud, self-hosted vLLM, and others, ships with a ctester report in examples/tests/…
- Current catalogues — GPT-6, Claude Opus 5.x and Fable 5.x, Gemini 3.x, Qwen 3.8, GLM 5.3, DeepSeek V4, and Grok 4.7, with prices checked against vendor pages. Agent chains are compacted to the…
XBOW
An autonomous offensive security platform that attacks web applications, chains findings into working exploits and reports vulnerabilities with reproducible proof, for continuous testing rather than periodic manual pentests.
Pricing: Usage-based pricing scoped to the environment; no public prices. Also sold through the AWS, Google, Oracle and Microsoft marketplaces.