PentAGI v2.2.0 - Any Modern LLM, a Contained Sandbox, Unified Web Search & Multi-Instance Deployment
We're excited to announce PentAGI v2.2.0 — a major release for the current generation of LLMs, sandbox security, and flows that behave predictably!
Key Improvements:1.
Any Modern LLM - A LangChainGo upgrade sends reasoning in each vendor's native form, so current models from GPT-6 and Claude Opus 5.x to Gemini 3.x work without workarounds.
MiniMax,
Mistral, and
xAI join as providers, any OpenAI-compatible endpoint (including Azure OpenAI) works through the custom provider, and every provider ships with a tested configuration
2.
Sandbox Security & CVE-2026-14784 - Up to 2.1.0, DOCKER_INSIDE=true mounted the host Docker socket into every sandbox. Prompt injection cannot be fully prevented, so 2.2.0 focuses on containment: an explicit capability allow-list, no host socket, a separate daemon for nested Docker, and an optional startup attestation. A shell that lands in a worker now stays there in the vast majority of cases — finish flows you no longer need
3.
Unified web_search Tool - Agents send a query and an intent ( links, answer, research, exploit ), and a failing engine falls through to the next. Adds
Firecrawl and an opt-in engine that needs no paid API
4.
Multi-Instance Deployment - TENANT_ID lets several installations share one PostgreSQL, worker node, Graphiti, and Langfuse
5.
Provider Failover & Keyless Anthropic - LLM_FALLBACK_PROVIDER repeats a failed model call on a second provider, and Anthropic can authenticate through Workload Identity Federation instead of a long-lived key
6.
Flows That Do What the Buttons Say - Creating a flow returns at once, stopping ends the commands it started in the sandbox, finishing removes its containers, and assistant replies survive reconnects
7.
Markdown Editor for Prompts & Templates - Prompts and flow templates move from plain text boxes to the rebuilt TipTap editor used for knowledge documents, with tables, highlighting, and a Rich/Raw toggle
8.
Installer for macOS & Windows - The latest installer is now available for macOS as a signed executable and for Windows, in addition to Linux
9.
Updated Kali Image & MCP Gateway - vxcontrol/kali-linux is rebuilt with new tools, and its mcp tag adds an MCP gateway with a useful set of servers
10.
Update Notifications - You can now learn about a new version right in the product interface
Important for Existing Users:Everyone signs in again after the upgrade; behind a reverse proxy, set TRUSTED_PROXIES. MinIO no longer publishes images: if .env sets MINIO_IMAGE=minio/minio:…, switch it to cgr.dev/chainguard/minio:latest. If your .env has DOCKER_INSIDE=true without DOCKER_INSIDE_HOST, agents lose Docker access until you point it at a separate daemon. Leave TENANT_ID empty, move custom prompts from ``.`GoogleToolName` and similar to ``.`WebSearchToolName`, and audit local account emails before enabling OAuth. Migrations apply automatically: docker compose pull && docker compose up -d.
To get an Enterprise Edition license, sign up at
https://console.pentagi.com — new users get one free license there.
LangChainGo release notes:
https://github.com/vxcontrol/langchaingo/releases/tag/v0.1.14-update.8Full release notes:
https://github.com/vxcontrol/pentagi/releases/tag/v2.2.0
