Strix

usestrix's open-source autonomous pentesting agent: a CLI that points a team of LLM agents at a codebase, a GitHub repo, or a deployed web app, and has them find vulnerabilities and prove them with working exploits. Apache 2.0, 59,398★ / 6,480 forks (GitHub API, 2026-08-30; ~44.8k when this page was written on 2026-07-27), shipped as strix-agent on PyPI and run inside a Docker sandbox.

It is by a wide margin the most capable and most widely adopted tool this spoke has recorded, and the first where the agents act on the target rather than gathering information about it.

Where it sits on this spoke's autonomy axis

ai-osint tracked a progression: llm-osint (one model, one loop) → kallisto-osinter (orchestrated specialist agents). Both gather. Strix keeps the orchestration — a "Graph of Agents" with specialists for recon, exploitation and post-exploitation, running in parallel across targets and sharing findings so one agent's discovery feeds another's chain — and extends the axis past collection into action. Reconnaissance (subdomain enumeration, attack-surface mapping, fingerprinting) is one agent among several here, the first step of a longer automated chain rather than the product.

The toolkit

The README's framing is that the agents get what a human tester gets: an intercepting HTTP proxy (Caido), a Playwright browser for client-side testing, an interactive shell, a Python sandbox for writing and running proof-of-concept exploits, recon tooling, and combined SAST + DAST over source. Findings land in a structured knowledge base with CVSS scores and OWASP classification. Coverage is described as OWASP Top 10 and beyond: access control, injection, server-side (SSRF, XXE, deserialization, RCE), client-side, business-logic, authentication/session, cloud misconfiguration, and API classes. Built on LiteLLM, Caido, Nuclei, Playwright and Textual.

Exploit validation as the evidence standard

The product argument is aimed at scanner noise: "working PoCs, not false positives." A finding counts only when the agent has demonstrated it, with reproduction steps attached. That is a stronger evidence discipline than anything else in this corpus — llm-osint and kallisto-osinter assert profiles nobody checks — and it is available here because the target is the oracle. An exploit either fires or it doesn't, which is exactly the ground truth an OSINT profile lacks. Note what it doesn't claim: no independent benchmark, no measured false-negative rate, no published comparison against human testers. Retracted 2026-09-03 (absence-claim drain), and the replacement is worse for Strix than the absence was.

An independent benchmark exists and has since 30 April 2026. Escape Technologies ran four agentic pentesting tools against Duck Store, a deliberately vulnerable web app seeded with 20 known vulnerabilities, under stated grey-box conditions — each tool got the target URL, a pointer to /openapi.json, the API surface and default credentials, one run each. The results:

Read the conflict of interest before reading the table. Escape wrote the benchmark, entered its own product, and won it. That does not make the numbers false and it does mean nobody has re-run them — which is the hub's standing "nobody re-runs anybody's numbers" item arriving in its purest form: the only independent measurement of this tool was published by a competitor. Corrected 2026-09-14: no longer the only one. Ridge Security published its own RidgeGen-vs-Shannon-vs-Strix run on OWASP Juice Shop in March 2026 — a second competitor grading Strix on a suite the competitor chose — and Protego ran Strix against its own single website (nothing found, ~$17 in tokens), which is independent but is one site and not a benchmark. So: two competitor benchmarks and one non-competitor anecdote; still nobody neutral has re-run the numbers. A second evaluation exists in the literature (arXiv 2605.10834, "From Controlled to the Wild: Evaluation of Pentesting Agents for the Real-World"), where a Strix-Sonnet configuration is reported as comparatively precise while nearly doubling its recall and taking the highest cumulative F₀.₅ among the setups tested. Neither paper has been read here beyond its abstract, and the two point in different directions.

What survives from the paragraph above. The exploit-validation discipline is still the strongest evidence standard in this corpus, and Strix's 0% false-positive rate on Duck Store is that discipline doing exactly what it promises. What the benchmark adds is the other half of the ledger: on that run it also found one vulnerability out of twenty. Precision without recall is what an exploit-must-fire rule buys you, and it is now measured rather than argued. The vendor's own claim of solving 100 of 104 XBEN challenges by v0.4.0 is a CTF result, not a seeded-flaw recall rate on an application; the two are not comparable.

Red team on every pull request

A GitHub Actions workflow, a --non-interactive mode that exits non-zero when it finds something, and automatic diff-scoping on PR runs. That turns offensive testing into a CI gate — continuous exploitation of your own application at commit cadence, with AI-generated patches offered as ready-to-merge PRs on the hosted platform. This is the shift-left / DevSecOps seam with ../defensive-security-wiki (which names AI-accelerated exploitation in its own domain).

The human dial is still there

strix view serves a local dashboard on 127.0.0.1 reading run files off disk, with a live map of which agent is doing what, and steering: you can send instructions into a running scan and redirect the agents mid-flight. Full autonomy with a hand on the wheel, the same augment/automate compromise kafsiem and sift-kg's human-gated merges reach by different routes.

Availability and the ethics line

Apache 2.0, a one-line install script, and model-agnostic configuration including local models (Ollama/LMStudio via LLM_API_BASE) and sign-in with a ChatGPT subscription instead of a metered API key. So the cost and access floor for running an autonomous exploitation agent is a consumer subscription or a local model. The only stated constraint is a README warning: "Only test apps you own or have permission to test. You are responsible for using Strix ethically and legally." No technical scope enforcement, no authorization check. See synthesis for what that does to this spoke's dual-use tension.

A third-party evaluation does exist, and it is unflattering (found 2026-08-30)

This page said there was none. That was an assumption, and the quality cycle's absence-claim queue caught it: Escape published a comparison of four agentic pentesting tools against Duck Store, a deliberately vulnerable FastAPI/React app with 20 known vulnerabilities, grey-box (target URL, OpenAPI spec, credentials), one run each.

Read the caveat before the number. The benchmark is published by Escape, whose own product comes first — the vendor-runs-the-comparison shape this corpus flags everywhere else, and the reason it is a T3 result rather than an independent one. Strix and Shannon ran on the same model (DeepSeek v3.2) and scored 5% against 30%, which points at the harness rather than the backbone; Shannon also got source-code access that Strix did not.

Two things survive the caveat and are worth holding. Strix's 0% false-positive rate is the best in the table, which is exactly what its "no PoC, no finding" rule is designed to buy — it will not report what it cannot exploit. And a 5% detection rate on a benchmark it did not choose sits a very long way from "act just like real hackers." The honest reading is that the design trades recall for precision, and nobody outside a competitor has measured where that lands.

Still missing: an evaluation by a party with nothing in the race.

Tier

T3 — a vendor README for a commercially backed open-source tool. Capability claims are self-reported and marketing-shaped ("act just like real hackers"). The star count and the model list are dated snapshots; both were refreshed 2026-08-30.

Related

autonomous-pentesting · usestrix · ai-osint · osint · ip-reconnaissance · swaggerspy · kallisto-osinter · synthesis