strix

Start with an existing open source AI pentesting / source code scanning tool. Shannon and Strix are 2 that come to mind. They provide the tools, prompt, and frameworks for the model to use. https://github.com/KeygraphHQ/shannon https://github.com/usestrix/strix

would love it to see it h2h against https://github.com/usestrix/strix (45k stars)

The off-the-shelf player in this space (structured red-team search) is probably https://github.com/usestrix/strix (no affiliation). But any frontier model, if you tell it "here's how the authentication system works, go looking for bugs" will probably do a good job.

Strix (strix.ai, https://github.com/usestrix/strix)| Founding Engineer | NYC/SF We built the largest open-source AI pentesting framework — 25k GitHub stars, 80k active users, 15B LLM tokens processed daily, 1,800 pentests run per day. Two of us right now. You'd be the third. Looking for a founding-engineer engineer who's done 0→1 before and wants to own the architecture of something already at scale. You'll touch everything — infra, product, research tooling. Python/TypeScript stack, AI-native workflows, real security problems. Email hiring@usestrix.com — tell us something you've built and why it was hard.

Hey HN - this is Allam, creator of Strix. Strix is a fully open-source penetration testing agent. It finds real vulnerabilities in real apps, validates them, and generates detailed reports with PoCs. Recently, companies like XBOW and others have claimed to build “the best AI hacking agents.” But so far, none are open, transparent, or usable - mostly marketing, benchmarks, and waitlists. We launched Strix just a month ago. Since then, it’s grown to ~2,000 stars on GitHub and ~8,000 downloads. Today, Strix is already being used by security engineers at Fortune 500s, top 1% bug bounty hunters on HackerOne, and major auditing/compliance firms - finding 100s of critical vulnerabilities in production systems and OSS projects. We built Strix because we believe security should be open, accessible, and trusted - not hidden behind closed tools for

This is a neat project, I don't know why you'd want to set it up with this comparison to Xbow. As someone who works (worked? I'm non-ironically still trying to figure out if I belong in this space post-AI!) in this space and knows some of the actors, I'm pretty sure there's more to Xbow than ~1800 lines of prompts. Like: this is your RCE template prompt: https://github.com/usestrix/strix/blob/main/strix/prompts/vu... ... and this is great, I'm not dunking, but pretty basic? We just had the DARPA AIxCC results come in, and those systems are (1) open source and (2) presumably simpler/less polished than Xbow (some of the authors will be quick to tell you that they're doing PoC work, not product development), and (3) they're more complicated than this. Again, to be super clear: I think there's a huge amount of potential in building something

I built an open-source AI agent for security testing to find and fix vulnerabilities in your code. I’ve noticed how bad security vulnerabilities have gotten with everyone shipping AI code slop, so I wanted to build something that allows for vibe-coding at full speed without compromising security. Traditional security tools aren’t effective, and manual pen-testing can’t keep up with the rapidly growing AI code This tool runs your code dynamically, finds vulnerabilities, and validates them through actual exploitation. You can either run it against your codebase or enter your (or someone else’s) domain to scan for vulnerabilities. Good luck, have fun, hack responsibly!