# Using Strix Open‑Source AI Hacker for Automated Penetration Testing (Windows)

> Strix is an open-source AI hacker that automates penetration testing with large language models. On Windows, install it with pipx install "strix-agent[vertex]", enable Vertex AI on a billed Google Cloud project, set the STRIX_LLM, VERTEXAI_PROJECT and VERTEXAI_LOCATION environment variables, authenticate with gcloud auth application-default login instead of an API key, then run it against a target you are authorized to test.

- **Author:** Sivanandam S (https://www.sivanandam.in/)
- **Published:** 2026-01-13
- **Updated:** 2026-01-13
- **Section:** Security Testing
- **Tags:** Strix, penetration testing, AI security, Vertex AI, Gemini 2.5 Pro, Windows
- **Canonical URL:** https://www.sivanandam.in/blog/using-strix-ai-hacker-automated-pentesting-windows/

## Key takeaways

- Strix runs on Windows through pipx; the [vertex] extra adds Google Vertex AI support.
- Vertex AI needs a Google Cloud project with aiplatform.googleapis.com enabled and billing active.
- Authentication uses Google Cloud Application Default Credentials, so no API key is stored on disk.
- Three environment variables configure the model: STRIX_LLM, VERTEXAI_PROJECT and VERTEXAI_LOCATION.
- Gemini 2.5 Pro suits security scanning because long-context reasoning and code analysis matter more than speed.
- Only scan applications you have explicit authorization to test.

## Overview

- **OS:** Windows
- **Tool:** Strix (open‑source AI hacker)
- **LLM Provider:** Google Vertex AI
- **Model:** `vertex_ai/gemini-2.5-pro`
- **Authentication:** Google Cloud Application Default Credentials
- **Target Application:** Dummy web application

## Prerequisites

Ensure the following are installed and running:

- Python
- Docker
- Google Cloud SDK
- LLM Provider Access

### Authentication Notes

- No API key required
- Authentication handled via Google Cloud Application Default Credentials

## Step 1: Install Strix

Since this setup uses Gemini models via Vertex AI, install Strix with Vertex support:

```
pipx install "strix-agent[vertex]"
```

If you plan to use OpenAI or Claude instead, install Strix without extras:

```
pipx install strix-agent
```

## Step 2: Create or Select a Google Cloud Project

Vertex AI requires a Google Cloud project.

### Option A: Use an Existing Project

If you already have projects in GCP:

```
gcloud projects list
```

Select one from the list.

### Option B: Create a New Project (Recommended)

```
gcloud projects create my-strix-project
gcloud config set project my-strix-project
```

## Step 3: Enable Vertex AI

Enable the Vertex AI API for the selected project:

```
gcloud services enable aiplatform.googleapis.com
```

Alternatively, enable it through the Google Cloud Console:

```
https://console.developers.google.com/apis/api/aiplatform.googleapis.com/overview?project=<your_project>
```

### Enable Billing

Vertex AI requires billing to be enabled for the project:

```
https://console.developers.google.com/billing/enable?project=<yourproject>
```

## Step 4: Configure Environment Variables

Set the required environment variables in Command Prompt (`cmd.exe`):

```
set STRIX_LLM=vertex_ai/gemini-2.5-pro
set VERTEXAI_PROJECT=my-strix-project
set VERTEXAI_LOCATION=us-central1
```

## Step 5: Authenticate with Google Cloud

Authenticate using Application Default Credentials:

```
gcloud auth application-default login
```

This allows Strix to securely access Vertex AI without storing API keys.

## How do you run Strix against a target application?

### Run with Inline Instructions

```
strix --target https://dummy-app.example.com --instruction "perform authenticated testing using credentials: username:password"
```

### Run with an Instruction File

```
strix --target https://dummy-app.example.com --instruction-file ./instructions_pentest.md
```

## What does a Strix instruction file look like?

Below is a sample `instructions_pentest.md` file:

```
# Penetration Test Instructions

## Credentials
- Admin: admin_user / StrongPassword@123

## Focus Areas
1. Injection Attacks – SQL, NoSQL, command injection
2. Server-Side Issues – SSRF, XXE, deserialization flaws
3. Infrastructure – Misconfigurations, exposed services
4. Client-Side – XSS, prototype pollution, DOM vulnerabilities

## In Scope
/app-audit
/admin-console
/vendor-dashboard

## Out of Scope
- Third-party integrations
```

## Why use Gemini 2.5 Pro for security scanning?

- Latest stable Pro‑grade Gemini model
- Deep reasoning and long‑context understanding
- Strong performance in code analysis and vulnerability discovery
- Ideal for security scanning where quality matters more than speed

## Final Thoughts

Using Strix with Vertex AI Gemini 2.5 Pro provides a powerful, automated approach to penetration testing. By relying on Google Cloud’s authentication and managed AI infrastructure, you avoid API key management while benefiting from high‑quality security analysis.

Always ensure you have explicit authorization before running security scans against any application.

### Disclaimer

This content is for educational and authorized security testing purposes only.

## Frequently asked questions

### How do I install Strix on Windows?

Install it with pipx. Use pipx install "strix-agent[vertex]" for Google Vertex AI support, or pipx install strix-agent if you plan to use OpenAI or Claude models instead. Python, Docker and the Google Cloud SDK must be installed and running first.

### Does Strix need an API key to use Gemini 2.5 Pro?

No. With Vertex AI, Strix authenticates through Google Cloud Application Default Credentials. Run gcloud auth application-default login once and Strix reaches the model without any API key stored on your machine.

### Which environment variables does Strix need for Vertex AI?

Three: STRIX_LLM set to vertex_ai/gemini-2.5-pro, VERTEXAI_PROJECT set to your Google Cloud project ID, and VERTEXAI_LOCATION set to a region such as us-central1.

### How do I give Strix detailed penetration testing instructions?

Pass a markdown instruction file with strix --target <url> --instruction-file ./instructions_pentest.md. The file can list credentials, focus areas such as injection and SSRF, and explicit in-scope and out-of-scope paths.

### Why use Gemini 2.5 Pro for automated security testing?

It is a Pro-grade model with deep reasoning and long-context understanding, and it performs well on code analysis and vulnerability discovery - qualities that matter more than raw speed for security scanning.

---

Written by Sivanandam S. ISTQB certified test analyst with over 15 years of experience testing web, mobile, OTT, chatbot and smart wearable applications, and building dedicated testing services for teams across multiple locations.