Someone Just Open Sourced an Autonomous AI Hacker

0:00Watch this. This is a login form on a completely stock OWASP Juice Shop instance, a sandbox people use to practice security testing. I type one line into the email field, no password that means anything, and I'm in. No account, no credentials, just a string that breaks the query the server runs to check my login. That's the exact class of bug that a new open source project called Strix is built to find automatically at scale with AI agents instead of a human typing it in by hand. It's on GitHub. It's sitting at over 67,000 stars, and in the security community, it's already turning heads. So, in this video, I'm going to

0:40pull apart the repo, show you exactly how the agents are built, read the actual skill files they load mid-scan, and then be straight with you about the one big thing I could not verify myself and why. Strix is built around one idea. Instead of one AI with a giant prompt listing every hacking technique on Earth, it spins up agents that load specific skills on demand. The docs describe it as a multi-agent system with its own browser, an HTTP proxy, a terminal, and a full sandbox of real security tools like nuclei and ffuf baked in. When an agent needs deep technique on something, it calls a tool called skill, and that

1:20pulls in up to five markdown files of real tradecraft right into its context. I went and read the actual skill files on GitHub, not just the docs describing them. There's a whole library here, categorized the way a real pen test team would organize it. Vulnerability classes like SQL injection, XSS, SSRF, JWT attacks, business logic flaws, race conditions, framework-specific skills for Django, FastAPI, Next.js, cloud skills for AWS, Azure, GCP, Kubernetes, even skills for testing LLM applications and prompt injection, which tells you this project is being built for what

2:01people are actually shipping in 2026. Here's the SQL injection skill file in full. It's not a vague description. It's a real reference. How to detect SQL injection through error messages, through boolean differences between two requests, through timing with sleep and sleep and wait for, broken down by database engine and by where the input

2:23lands. A URL, a JSON body, a header. This is the kind of document an agent reads right before it tries to break your login form. Installing Strix is one line. curl - SSL https://strix.ai/install

2:41pipe bash. And then you point it at a target, a folder on your machine, a GitHub repo, or a live URL. You set an environment variable for your LLM. Strix runs on top of Lite LLM, so it works with OpenAI, Anthropic, Gemini, or even a local model through Ollama. And then one command kicks off the scan. There are three scan modes and the difference matters. Quick mode is built for CI, a pull request check that takes minutes. Standard is 30 minutes to an hour. Deep mode, which is the default, is one to four hours because it's chasing chained vulnerabilities and edge

3:18cases, not just the obvious stuff. Now, here's where I have to be honest with you because I actually tried to run this live and it did not go the way I expected. I got Docker working, I installed Strix, I pointed it at my local Juice Shop sandbox, and then I spent way longer than I'd like to admit just finding an AI model that would actually run it. Google's Gemini flat out refused. Its own safety filter

3:43blocked the request mid-scan. A paid model through open router worked and genuinely made real tool calls against the target, but I burned through the free quota before it finished. Grox's API rejected Strix's own tool format outright, a technical mismatch, not a refusal. So, what you're about to see is not the full scan I wanted to show you. It's the real unedited result of what happened when I pointed it at a free local model instead, because that's the one path

4:11that didn't cost anything. What I can show you for real is the kind of target this thing is aimed at. That login bypass I opened with, that's not me guessing. That's a documented intentional challenge built into Juice Shop, the exact kind of app Strix's authentication and SQL injection skills are written to catch. A human tester

4:31finds that by trying payloads by hand. Strix's pitch is that an agent tries a library of these automatically across every endpoint it finds without getting bored or skipping one. So, here's the catch, and this time I'm not pulling it from the documentation. I watched it happen myself. I ran Strix against my local Juice Shop sandbox using a free model through Ollama, running entirely on my own

4:55machine. And it stalled. Every single one of the first 10 turns, the agent gave a plain text response instead of actually calling a tool, and Strix had to force it to continue each time. 10 tries, zero real actions taken. It never got far enough to even start looking at the login page. That lines up exactly with what Strix's own documentation admits, that self-hosted models have, and I'm quoting their wording here, "lower reasoning that struggles with agents compared to the Frontier Cloud models it's built around." I'd call that an

5:29understatement based on what I watched. If you want to run this for free on your own GPU, budget for it not working well, at least not yet. The paid model, the one that actually worked and made real tool calls, cost real money per request, and I ran out of free credit before it reported back a single confirmed finding. So, even on the capable side, this is not a 5-minute free lunch. A real scan costs something in money or in your own patience, and anyone telling

5:58you otherwise hasn't actually run it. And one more thing, because Strix actively tries to exploit what it finds rather than just flagging it, running it against anything you don't own or don't have explicit written permission to test is not a gray area. It's illegal. The sandboxed, local, or CI pipeline use case is the legitimate one, and it's the one the project's own docs point you toward with the GitHub Actions integration. Even with a messy test run, what's sitting in this repo is a real shift. For years, deep security testing meant either an expensive outside firm or a noisy scanner that buried you in false positives. Here, you've got an

6:38agent architecture, a real tool sandbox, and a skills library that reads like actual pen test notes. All open source under Apache 2.0, free to read and free to run against your own stuff. I'm not going to tell you it replaces a human pen tester, because what I actually watched was a free model falling on its face, and a paid model running out of credit before it finished. But, the architecture is serious, and the skill files are serious. And I think with a properly funded model behind it, this thing does what it claims. I'm putting money into a real, complete run for a follow-up, and I'll show you exactly

7:14what it finds, mistakes and all. The repo's linked in the description. Let me know in the comments if you want that follow-up, and I'll see you in the next one.