Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-17 · high
Seven commits landed on August 17, and the open-source pentesting agent picked up 856 GitHub stars within a day.
Why now: The seven commits and the 856-star jump both happened on August 17.
Strix started requiring a traceable call path before flagging a dependency CVE, in seven commits landed on August 17, per the project's GitHub repo.
Strix now computes a full eight-metric CVSS environmental score for every dependency finding. This is aimed at software-composition-analysis noise: tools that flag every CVE in a dependency tree even when the vulnerable function never runs. A CVE only counts as exploitable if Strix can show the call path that reaches it.
The team iterated live in the commit history. They required per-metric reasoning for the CVSS breakdown, dropped it, then re-added it only for metrics that survive filtering. The usage-evidence rule on dependency findings came last, and it stuck. That kind of live iteration is unusual for a security tool. Most vendors ship a scoring change behind a version bump, not seven visible commits.
The repo picked up 856 stars in 24 hours, reaching 53,614. Searching for it comes with a trap: strixproject/Strix and arandomguyhere/strix both exist on GitHub too, at 2 and 1 stars.
The open question is what happens when a real vulnerability sits behind a path Strix's tracer can't reach. The commits don't say.
Each link below shares sources, entities, or timing with this story.
Shared entities / Same source / Shared topic / Earlier coverage / Tension
Both cover CVSS, GitHub, Strix; cite the same source (GitHub); overlapping topics (agent, strix).
Shared entities / Same source domain / Shared topic / Earlier coverage
Both cover GitHub, Watch; reported by the same outlet (github.com); overlapping topics (agent, star).
Shared entity: GitHub / Same source domain / Shared topic / Earlier coverage / Tension
Both cover GitHub; reported by the same outlet (github.com); overlapping topics (agent, answer, dependency).
Both cover GitHub; reported by the same outlet (github.com); overlapping topics (agent, finding, star).
Shared entity: GitHub / Same source domain / Shared topic / Earlier coverage
Both cover GitHub; reported by the same outlet (github.com); overlapping topics (added, agent, answer, star).
Shared entity: GitHub / Same source / Shared topic / Earlier coverage
Both cover GitHub; cite the same source (GitHub); overlapping topics (agent, star).
Shared entities / Shared topic / Earlier coverage
Both cover CVE, CVSS; overlapping topics (agent, cvss, hour); earlier CVE coverage from 2026-07-11.
Both cover CVE, CVSS; overlapping topics (agent, cvss, finding); earlier CVE coverage from 2026-03-15.