Strix
Tied for most recommended of 5 pentest tools
Free open-source AI agent that tests for vulnerabilities and is praised for real findings. Main caveat: critics say it can go beyond authorized targets.
Free open-source AI agent that tests for vulnerabilities and is praised for real findings. Main caveat: critics say it can go beyond authorized targets.
15 people gave an opinion
- recommend it
- 9
- criticize it
- 6
- approval share
- 60%
Recommended in 4 of 13 months
- November 2025: not recommended
- December 2025: not recommended
- January 2026: not recommended
- February 2026: not recommended
- March 2026: recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: not recommended
- July 2026: not recommended
- August 2026: not recommended
- September 2026: recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 9 people recommend itNeeds 10 or more, not met.
- 1.5 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 4 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Finds real vulnerabilities and discloses them responsibly
“Kudos for Strix to find it, and especially with how it chose to disclose and report it.”
Comment from 15 Sep 2026 in “We got admin access to Baseten's production GitHub” “I don't think someone can have a better story to advertise their own security product.”
Comment from 15 Sep 2026 in “We got admin access to Baseten's production GitHub” “As I tested it against retired Hack The Box machines, I knew what should be reported”
Comment from 4 Mar 2026 in “First Impressions on Open-Source Claude Security (Strix)” Open-source framework with tools and prompts
“They provide the tools, prompt, and frameworks for the model to use.”
Comment from 16 Sep 2026 in “DeepSeek v4.1 Flash Is Now Our Best Hacking Model” “We built the largest open-source AI pentesting framework”
Comment from 1 May 2026 in “Ask HN: Who is hiring? (May 2026)”
What people warn about
Each mark is one comment
Acts beyond authorized targets and legal bounds
“You're going past the white-hat point here when you start active exfiltrating data and looking at it.”
Comment from 15 Sep 2026 in “We got admin access to Baseten's production GitHub” “it is apparent that while Strix want to ensure their customers only run it against domains they own”
Comment from 16 Sep 2026 in “We got admin access to Baseten's production GitHub” “A security company who KNOWS the law unleashed an AI agent to violate the laws”
Comment from 15 Sep 2026 in “We got admin access to Baseten's production GitHub” Misses bugs and fails to finish runs
“they actually miss so many vulnerabilities that other platforms do find”
Comment from 15 Apr 2026 in “Open Source Isn't Dead. Cal.com Just Learned the Wrong Lesson” “we never managed to get strix to actually complete”
Comment from 4 May 2026 in “U.S. military data left exposed at an a16z startup for 150 days”
Other pentest tools people recommend
The four most recommended other pentest tools, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| StrixThis page | 9 | 6 | 60% | 4 | — | — |
| Burp Suite | 9 | 1 | 90% | 6 | — | — |
| Deadend CLI | 6 | 0 | 100% | 1 | — | — |
| SmokedMeat | 6 | 0 | 100% | 1 | — | — |
| ZAP (Zed Attack Proxy) | 5 | 1 | 83% | 5 | — | — |
What people said
14 of the 15 comments that mention it, newest first. Each links to the original comment.
“They provide the tools, prompt, and frameworks for the model to use.”
“it is apparent that while Strix want to ensure their customers only run it against domains they own”
“It didn't do anything that I couldn't do, if I wanted to.”
“You're going past the white-hat point here when you start active exfiltrating data and looking at it.”
“A security company who KNOWS the law unleashed an AI agent to violate the laws”
“Kudos for Strix to find it, and especially with how it chose to disclose and report it.”
“I don't think someone can have a better story to advertise their own security product.”
“i quite liked using strix”
“we never managed to get strix to actually complete”
“We built the largest open-source AI pentesting framework”
“they actually miss so many vulnerabilities that other platforms do find”
“Strix was so close to being the hero we deserve”
“As I tested it against retired Hack The Box machines, I knew what should be reported”
“while letting the agent still explore freely”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.