Strix - Someone Open-Sourced an Entire Army of AI Hackers That Break Into Your App for You

Strix - Someone Open-Sourced an Entire Army of AI Hackers That Break Into Your App for You

Links & Resources

Someone built an open-source army of AI agents that hack your application - and then fix it. It's called Strix, it has 25.6K GitHub stars, and the way it works is genuinely different from anything else in security tooling.

You point it at your code. It doesn't just scan it. It attacks it like a real hacker. Runs your app live, finds the vulnerability, proves it with a working exploit, and hands you a ready-to-merge pull request with the fix.

One command to install. Point it at your repo. Done. A whole team of AI agents goes to war on your code.

What Strix Actually Does

Most security tools scan your code statically - they look at the text of your source files and flag patterns that might be vulnerable. The result is a wall of false positives that nobody reads.

Strix is different. It deploys autonomous AI agents that behave like real penetration testers. They don't just read the code - they run it. They interact with your live application, probe endpoints, chain vulnerabilities together, and prove each finding with an actual working exploit (a proof-of-concept). If it can't prove it, it doesn't report it.

Then it writes the fix and hands you a PR.

The Numbers

How It Works - The Agent Architecture

Strix mirrors how real penetration testing teams operate. It's not one model doing everything - it's a coordinated team of specialized agents.

The Manager (The Brain)

The high-level planner that receives the target and scope, breaks the objective into granular tasks, decides which tools are necessary based on context, and dynamically adjusts strategy based on real-time findings.

The Workers (The Hands)

Specialized sub-agents that execute specific attack types. One agent digs out SQL injection. Another finds broken access control. Another tests for XSS. Another writes the fix.

The Loop

Every agent runs a Think → Plan → Act → Observe cycle:

Think: "The /api/users endpoint accepts a user_id parameter. Let me test for IDOR."
Plan:  "I'll request /api/users/1 with a session token for user 2."
Act:   [Makes the HTTP request, observes the response]
Observe: "I received user 1's data while authenticated as user 2. Confirmed IDOR."

The agents collaborate and share discoveries in real time. If one agent finds an authentication weakness, others can leverage it to probe deeper.

Graph of Agents

Strix uses a Graph of Agents architecture for advanced multi-agent orchestration:

• Distributed Workflows - Specialized agents for different attack types and assets
• Parallel Execution - Multiple agents testing simultaneously for fast, comprehensive coverage
• Dynamic Coordination - Agents share findings and adapt strategy based on what others discover

The Full Hacker Toolkit

Every Strix agent comes equipped with professional penetration testing tools out of the box:

What It Can Find

Strix covers the full OWASP Top 10 and beyond:

Benchmark - 96% Success Rate

Strix v0.4.0 was tested on the XBEN benchmark - 104 web security challenges in CTF format:

Performance by difficulty:

The hard challenges often require vulnerability chaining and advanced multi-step exploitation - exactly the kind of thing that separates a real pentest from a scan.

Quick Start - One Command

Prerequisites

• Docker (running)
• An LLM API key (OpenAI, Anthropic, Google, or any supported provider)

Install and Run

# Install Strix
curl -sSL https://strix.ai/install | bash

# Configure your AI provider
export STRIX_LLM="openai/gpt-5.4"
export LLM_API_KEY="your-api-key"

# Run your first security assessment
strix --target ./app-directory

First run automatically pulls the sandbox Docker image. Results are saved to strix_runs/<run-name>.

Recommended Models

Strix is built on LiteLLM, so it works with any supported provider - including local models via Ollama or LMStudio.

Usage Modes

Scan a Local Codebase (White-Box)

strix --target ./app-directory

The agents read your source code AND run the application, combining static analysis with live exploitation.

Scan a GitHub Repo

strix --target https://github.com/org/repo

Point it at any public (or accessible) repo. Strix clones it, analyzes the code, spins up the app, and attacks.

Black-Box Web App Assessment

strix --target https://your-app.com

No source code needed. Strix probes the live application like an external attacker.

Authenticated Testing (Grey-Box)

strix --target https://your-app.com \
  --instruction "Perform authenticated testing using credentials: user:pass"

Multi-Target Testing

strix -t https://github.com/org/app -t https://your-app.com

Test the source code and the deployed app simultaneously - find vulnerabilities that only exist in one or the other.

Focused Testing

strix --target api.your-app.com \
  --instruction "Focus on business logic flaws and IDOR vulnerabilities"

Tell the agents exactly what to hunt for.

CI/CD Integration - Block Insecure Code Automatically

Strix plugs directly into GitHub Actions. Run a security test on every pull request. Block insecure code before it reaches production.

name: strix-penetration-test

on:
  pull_request:

jobs:
  security-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v6
        with:
          fetch-depth: 0

      - name: Install Strix
        run: curl -sSL https://strix.ai/install | bash

      - name: Run Strix
        env:
          STRIX_LLM: ${{ secrets.STRIX_LLM }}
          LLM_API_KEY: ${{ secrets.LLM_API_KEY }}
        run: strix -n -t ./ --scan-mode quick

The -n (non-interactive) flag runs Strix headlessly - perfect for automated pipelines. Exits with a non-zero code when vulnerabilities are found, so your CI pipeline fails on insecure code.

In PR runs, Strix automatically scopes quick reviews to changed files only, so it's fast.

Strix Platform - The Hosted Version

Don't want to self-host? The full-stack platform at app.strix.ai adds:

• One-click autofix as ready-to-merge pull requests
• Continuous monitoring across code, cloud, and infrastructure
• Integrations with GitHub, Slack, Jira, Linear, and CI/CD pipelines
• Continuous learning that builds on past findings and remediations

Free to sign up. Connect your repos and domains. Launch a pentest in minutes.

Use Cases

Enterprise

For teams that need SSO (SAML/OIDC), custom compliance reports, dedicated support with SLA, VPC/self-hosted deployment, BYOK model support, and tailored agents optimized for your environment - request a demo.

The Bottom Line

Traditional penetration tests take weeks and cost tens of thousands of dollars. Static analysis tools drown you in false positives. Strix sits in between - it attacks your app like a real hacker, proves every finding with a working exploit, and generates the fix. All for ~$3.37 per vulnerability at benchmark scale.

The 96% success rate on XBEN with an average 19-minute solve time per challenge means it's not a toy. This is a legitimate pentest automation tool that happens to be open source and free to use.