Strix Blog https://www.strix.ai/blog Security research, product updates, and insights from the Strix team on autonomous pentesting, application security, and vulnerability management. en Same Subject, Wrong User: A Cross-Issuer Account Takeover in n8n https://www.strix.ai/blog/n8n-cross-issuer-account-takeover https://www.strix.ai/blog/n8n-cross-issuer-account-takeover Wed, 15 Jul 2026 00:00:00 GMT Strix pointed itself at n8n's token-exchange flow and found an identity-binding bug: two trusted issuers emitting the same sub map to the same local account. One trusted token could log you in as someone else. One Click Account Takeover in Granola: How a Notification Link Broke Out of Electron https://www.strix.ai/blog/granola https://www.strix.ai/blog/granola Sun, 05 Jul 2026 00:00:00 GMT Strix found a one-click account takeover in Granola's Electron app: a notification link could navigate a trusted renderer to an attacker's page while keeping Granola's privileged bridge. Training Specialized Pentesting Models with Reinforcement Learning https://www.strix.ai/blog/training-pentesting-models-with-rl-on-strix-harness https://www.strix.ai/blog/training-pentesting-models-with-rl-on-strix-harness Sun, 24 May 2026 00:00:00 GMT How we post-train smaller specialized models for specific vulnerability classes using RL inside the Strix harness. Securing a DoD Contractor: Finding a Multi-Tenant Authorization Vulnerability https://www.strix.ai/blog/how-strix-found-zero-auth-vulnerability-dod-backed-startup https://www.strix.ai/blog/how-strix-found-zero-auth-vulnerability-dod-backed-startup Sun, 03 May 2026 00:00:00 GMT Zero tenant isolation, exposed military training data, and a five-month responsible disclosure timeline. Autonomous Pentesting for Internal Infrastructure https://www.strix.ai/blog/autonomous-pentesting-for-internal-infrastructure https://www.strix.ai/blog/autonomous-pentesting-for-internal-infrastructure Fri, 17 Apr 2026 00:00:00 GMT Strix now runs inside your network, continuously pentesting the internal systems where real security failures usually happen. Context-Aware Pentesting https://www.strix.ai/blog/context-aware-pentesting https://www.strix.ai/blog/context-aware-pentesting Thu, 16 Apr 2026 00:00:00 GMT Strix now builds a living threat model of your organization and learns from every finding, so each pentest picks up where the last one left off. Introducing Strix API: Pentesting, Agent-Native https://www.strix.ai/blog/introducing-strix-api https://www.strix.ai/blog/introducing-strix-api Wed, 15 Apr 2026 19:00:00 GMT Run Strix pentests from CI, scripts, and coding agents, with HTTP APIs for pentests, vulnerabilities, schedules, and webhooks. Open Source Isn't Dead. https://www.strix.ai/blog/cal-com-is-closing-its-code-due-to-ai-threats https://www.strix.ai/blog/cal-com-is-closing-its-code-due-to-ai-threats Wed, 15 Apr 2026 16:00:00 GMT AI has changed vulnerability discovery, but closing source code does not remove the attack surface. Continuous AI defense is the better response. Pentesting Every Pull Request https://www.strix.ai/blog/pentesting-every-pull-request https://www.strix.ai/blog/pentesting-every-pull-request Tue, 14 Apr 2026 00:00:00 GMT Strix now pentests every pull request, blocking vulnerabilities before they reach production, so you can ship with confidence. Introducing the New Strix Platform https://www.strix.ai/blog/introducing-the-new-strix-platform https://www.strix.ai/blog/introducing-the-new-strix-platform Mon, 13 Apr 2026 00:00:00 GMT Strix is now a full-stack security platform for continuously pentesting, validating, and fixing vulnerabilities across your apps. Uncovering a hidden BOLA in Appsmith's snapshot logic https://www.strix.ai/blog/where-others-missed-it-appsmith-bola https://www.strix.ai/blog/where-others-missed-it-appsmith-bola Sun, 12 Apr 2026 00:00:00 GMT Strix autonomously discovered and reported a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path. How Strix found a critical auth bypass in etcd https://www.strix.ai/blog/where-others-missed-it-etcd-auth-bypass https://www.strix.ai/blog/where-others-missed-it-etcd-auth-bypass Sun, 12 Apr 2026 00:00:00 GMT Strix autonomously discovered and reported a critical authentication bypass in etcd, later designated as CVE-2026-33413. Where Cybersecurity Goes From Here https://www.strix.ai/blog/your-first-visitors-arent-users-theyre-bots https://www.strix.ai/blog/your-first-visitors-arent-users-theyre-bots Sun, 12 Apr 2026 00:00:00 GMT Why continuous AI-driven scanning has made periodic pentesting obsolete, and what teams need to change now. Best AI Pentesting Tools in 2026: 8 Platforms Compared https://www.strix.ai/blog/best-ai-pentesting-tools https://www.strix.ai/blog/best-ai-pentesting-tools Mon, 16 Mar 2026 00:00:00 GMT Compare the best AI pentesting tools in 2026, including Strix, XBOW, NodeZero, RunSybil, Pentera, Strobes, pwn.ai, and Prancer. Partnering with Caido to Bring Precision & Control to Agentic Pentesting https://www.strix.ai/blog/partnering-with-caido https://www.strix.ai/blog/partnering-with-caido Sun, 15 Mar 2026 00:00:00 GMT Security teams shouldn't have to choose between speed and control.