Strix retweeted
You can now run @strix_ai's open-source pen testing tool with any of AI Gateway's 400+ models. One API key, zero markup. vercel.com/changelog/strix-n…
Strix 🤝 @vercel
You can now power Strix’s autonomous pentesting agents with Vercel AI Gateway!
Access models from multiple providers through a single API, with built-in usage and cost tracking.
Get started: docs.strix.ai/llm-providers/…
You can now run @strix_ai's open-source pen testing tool with any of AI Gateway's 400+ models. One API key, zero markup. vercel.com/changelog/strix-n…
🎃 This Halloween, we're giving away $100,000 in AI pentesting credits!
October has been a horror show for security teams. Critical vulnerabilities, compromised packages, and leaked credentials, all in a matter of days.
Sign in with your business domain and run a free pentest on Strix.
Bonus: Share your personal sign-up link, and for every new business domain that signs up with it, you get another free pentest!
Sign up: app.strix.ai/
Introducing Strix Firewall, an open-source tool to protect your machine from the recent onslaught of software supply chain attacks.
Strix monitors every package installation at the OS level and blocks malicious dependencies before they reach your machine, whether installed by you or an AI agent.
Install it once, and it runs silently in the background. Also supports proxy mode across multiple package managers.
Strix retweeted
Open-weight models are getting ridiculously good.
DeepSeek V4.1-Flash-1017 just took #1 on our internal black-box pentesting benchmark: 316 known vulnerabilities across 8 live web apps.
F1 (findings combined across 3 runs) / total LLM cost:
- DeepSeek V4.1-Flash: 75.08 / $32.93
- GLM-5.3: 73.53 / $305.14
- GPT-5.6 Sol: 69.80 / $1,983.18
- Claude Opus 5: 70.12 / $3,032.39
An open-weight model outperformed every frontier model we tested, at roughly 1/90th the cost of Opus 5.
Pretty wild how quickly open models are progressing. They're no longer just the cheaper alternative. In some domains, they're already ahead.
Huge props to the @deepseek_ai team!
PostHog fixed the issue and has since shipped a strict CSP that blocks unsafe inline JavaScript.
They also audited all surveys and confirmed no exploitation beyond our tests. Huge thanks to their team for moving quickly and working with us.
Full write-up, agent traces, and video: strix.ai/blog/posthog-survey…
Try Strix on your next engagement or project: github.com/usestrix/strix
That’s their main product code, the GitOps repo that drives their clusters, and the distribution channel for their CLI.
A token used to fetch private dependencies had admin rights on all three.
That is an insane amount of access to leave in a public image!
We stopped at read-only checks and reported it.
Baseten confirmed it as critical and rotated the token by the next afternoon. Credit to their security team for handling it quickly.
Full write-up: strix.ai/blog/baseten-harbor…
Try Strix on your own apps: app.strix.ai/
