Strix is an open-source AI penetration testing tool with more than 70,000 stars on GitHub that uses autonomous agents to find vulnerabilities in your applications and help you fix them before attackers do.
Traditional security scanners pattern-match against known signatures and flood teams with false positives. Strix takes a different approach: it runs AI agents that actually execute your application, explore it the way a human pentester would, and prove each finding with a working proof of concept. The project is built for modern offensive security workflows including bug bounty hunting, CTF challenges, red teaming and continuous code-quality and security review. It integrates with GitHub Actions and CI/CD pipelines so every pull request can be scanned automatically, blocking insecure code before it reaches production. The repository is actively developed, with its latest push in October 2026, and is released under the Apache License 2.0.
Strix is maintained by the team at Strix AI and has grown quickly since its release, becoming one of the most-starred security projects on GitHub. Its agent architecture is designed to reason about an application’s actual behavior at runtime rather than its source code alone, which is why it catches logic flaws and chained vulnerabilities that signature-based scanners systematically miss.
Strix is open source under Apache-2.0 and free to self-host. Strix Cloud is a paid managed platform with validated findings, autofix and PR reviews, and an Enterprise tier adds SSO, compliance-ready reports and VPC or self-hosted deployment.
Security engineers, red teams, bug bounty hunters and engineering teams who want continuous, agent-driven penetration testing inside their development pipeline rather than occasional manual audits.