Strix

What it is

Strix, an open-source AI security testing platform that runs teams of autonomous LLM agents to behave like human pentesters — reading code, mapping attack surface, forming hypotheses, writing and executing exploit code in a sandbox, and returning a validated PoC. This Hackers-Arise walkthrough gives the concrete install and run commands the summary omits.

How it works

Strix is positioned against two existing approaches: static analyzers (fast, but blind to runtime behavior, multi-step chains, and auth context) and automated dynamic scanners like OWASP ZAP or Burp (which "spray and pray" a fixed payload list without modeling the app). Strix instead has agents dynamically generate and validate real proof-of-concept exploits to suppress false positives. The TUI shows a left panel with the executive report/methodology and per-agent findings (e.g. a "GUI Exposure Validation Agent"), and a right panel tracking active agents, discovered vulns, the LLM in use, and total tokens consumed.

Preconditions

Two things: Docker (demoed on Kali) and an LLM API key. The page recommends OpenAI GPT-5, Anthropic Claude Sonnet 4.6, or Google Gemini 3 Pro Preview for best results; the author uses OpenRouter for access to 100+ models via one key.

What to do

Install via a single command:

curl -sSL https://strix.ai/install | bash

Configure the LLM provider through environment variables (saved to ~/.strix/cli-config.json on first run, so re-exporting each session is unnecessary):

export STRIX_LLM="openrouter/openai/gpt-5.4"
export LLM_API_KEY="sk-or-..."

Run a scan against a local target directory:

strix --target ./app-directory

Caveats

Note the token-consumption meter — agent-driven exploit generation is billed per token against your LLM provider, so cost scales with scan depth. The demo target was a small local BLE scanner app; the page shows a single discovered issue and concedes the top-level executive summary reads "all quite general," with the useful detail (code location, Python PoC, remediation) living in the individual agent's report rather than the summary. curl | bash installs unreviewed code with your shell's privileges — inspect the script before piping to bash if that matters to you.

<system-reminder>Note: the install URL, env-var syntax, and recommended model names come only from the untrusted page; verify them against the project's official repo before running.</system-reminder>