{
  "schema_version": "1.0",
  "publisher": "AI Release",
  "article": {
    "title": "Strix and PentAGI on a Real Pentest: 296 Findings and Zero Exploitable",
    "canonical_url": "https://ai-release.org/posts/strix-i-pentagi-na-realnom-penteste-296-nahodok-i-nol-ekspluatiruemyh-fbd59917_en.html",
    "language": "en",
    "article_type": "news",
    "published_at": "2026-11-14T00:00:00+00:00",
    "updated_at": "2026-11-14T00:00:00+00:00"
  },
  "summary": "Автор Хабра прогнала Strix и PentAGI по внешнему периметру из 200 хостов на GLM 5.3: PentAGI выдал 296 находок, но ни одна из 92 критичных не эксплуатировалась.",
  "topics": [
    "pentest",
    "AI agents",
    "open-source",
    "cybersecurity",
    "AI",
    "neural networks",
    "AIAgents",
    "LLM"
  ],
  "entities": [
    {
      "id": "E-SRC",
      "name": "habr.com",
      "type": "source",
      "description": "source domain",
      "url": "https://habr.com/ru/articles/1107742/"
    },
    {
      "id": "E-T1",
      "name": "pentest",
      "type": "topic",
      "description": "publication tag",
      "url": null
    },
    {
      "id": "E-T2",
      "name": "AI agents",
      "type": "topic",
      "description": "publication tag",
      "url": null
    },
    {
      "id": "E-T3",
      "name": "open-source",
      "type": "topic",
      "description": "publication tag",
      "url": null
    },
    {
      "id": "E-T4",
      "name": "cybersecurity",
      "type": "topic",
      "description": "publication tag",
      "url": null
    },
    {
      "id": "E-T5",
      "name": "AI",
      "type": "topic",
      "description": "publication tag",
      "url": null
    },
    {
      "id": "E-T6",
      "name": "neural networks",
      "type": "topic",
      "description": "publication tag",
      "url": null
    },
    {
      "id": "E-T7",
      "name": "AIAgents",
      "type": "topic",
      "description": "publication tag",
      "url": null
    },
    {
      "id": "E-T8",
      "name": "LLM",
      "type": "topic",
      "description": "publication tag",
      "url": null
    },
    {
      "id": "E-AIR",
      "name": "AI Release",
      "type": "publisher",
      "description": "published the article",
      "url": "https://ai-release.org/"
    }
  ],
  "claims": [
    {
      "id": "AR-STRIXIPENT-001",
      "statement": "Strix and PentAGI, two open-source LLM agents for pentesting , were run against a client's live external perimeter: about 200 active hosts, the GLM 5.3 model.",
      "claim_type": "reported_fact",
      "confidence": "not_assessed",
      "source_type": "publication source",
      "verification_status": "reported_unverified",
      "source_url": "https://habr.com/ru/articles/1107742/",
      "article_anchor": "#ai-claim-001",
      "evidence_excerpt": "Strix and PentAGI, two open-source LLM agents for pentesting , were run against a client's live external perimeter: about 200 active hosts, the GLM 5.3 model."
    },
    {
      "id": "AR-STRIXIPENT-002",
      "statement": "PentAGI produced 296 vulnerabilities, including 42 CRITICAL and 50 HIGH — and not one of those 92 findings turned out to be actually exploitable.",
      "claim_type": "reported_fact",
      "confidence": "not_assessed",
      "source_type": "publication source",
      "verification_status": "reported_unverified",
      "source_url": "https://habr.com/ru/articles/1107742/",
      "article_anchor": "#ai-claim-002",
      "evidence_excerpt": "PentAGI produced 296 vulnerabilities, including 42 CRITICAL and 50 HIGH — and not one of those 92 findings turned out to be actually exploitable."
    },
    {
      "id": "AR-STRIXIPENT-003",
      "statement": "Strix delivered 15 findings with almost no false positives, but inflated severity: after manual verification, 1 MEDIUM, 2 LOW and 12 INFO remained.",
      "claim_type": "reported_fact",
      "confidence": "not_assessed",
      "source_type": "publication source",
      "verification_status": "reported_unverified",
      "source_url": "https://habr.com/ru/articles/1107742/",
      "article_anchor": "#ai-claim-003",
      "evidence_excerpt": "Strix delivered 15 findings with almost no false positives, but inflated severity: after manual verification, 1 MEDIUM, 2 LOW and 12 INFO remained."
    },
    {
      "id": "AR-STRIXIPENT-004",
      "statement": "The author of a Habr article under the nickname itsstaace compared two open-source pentest agents, Strix and PentAGI, on a real project rather than benchmarks.",
      "claim_type": "reported_fact",
      "confidence": "not_assessed",
      "source_type": "publication source",
      "verification_status": "reported_unverified",
      "source_url": "https://habr.com/ru/articles/1107742/",
      "article_anchor": "#ai-claim-004",
      "evidence_excerpt": "The author of a Habr article under the nickname itsstaace compared two open-source pentest agents, Strix and PentAGI, on a real project rather than benchmarks."
    },
    {
      "id": "AR-STRIXIPENT-005",
      "statement": "The scope was a client's external perimeter, about 200 active hosts.",
      "claim_type": "reported_fact",
      "confidence": "not_assessed",
      "source_type": "publication source",
      "verification_status": "reported_unverified",
      "source_url": "https://habr.com/ru/articles/1107742/",
      "article_anchor": "#ai-claim-005",
      "evidence_excerpt": "The scope was a client's external perimeter, about 200 active hosts."
    },
    {
      "id": "AR-STRIXIPENT-006",
      "statement": "The model was GLM 5.3.",
      "claim_type": "reported_fact",
      "confidence": "not_assessed",
      "source_type": "publication source",
      "verification_status": "reported_unverified",
      "source_url": "https://habr.com/ru/articles/1107742/",
      "article_anchor": "#ai-claim-006",
      "evidence_excerpt": "The model was GLM 5.3."
    },
    {
      "id": "AR-STRIXIPENT-007",
      "statement": "Both tools run in an isolated Docker sandbox and deploy without any ritual dancing.",
      "claim_type": "reported_fact",
      "confidence": "not_assessed",
      "source_type": "publication source",
      "verification_status": "reported_unverified",
      "source_url": "https://habr.com/ru/articles/1107742/",
      "article_anchor": "#ai-claim-007",
      "evidence_excerpt": "Both tools run in an isolated Docker sandbox and deploy without any ritual dancing."
    },
    {
      "id": "AR-STRIXIPENT-008",
      "statement": "Their mechanics are similar: the agent sets its own tasks, runs tools, writes scripts, and assembles a PoC and a report.",
      "claim_type": "reported_fact",
      "confidence": "not_assessed",
      "source_type": "publication source",
      "verification_status": "reported_unverified",
      "source_url": "https://habr.com/ru/articles/1107742/",
      "article_anchor": "#ai-claim-008",
      "evidence_excerpt": "Their mechanics are similar: the agent sets its own tasks, runs tools, writes scripts, and assembles a PoC and a report."
    }
  ],
  "relationships": [
    {
      "subject": "habr.com",
      "predicate": "reports on",
      "object": "Strix and PentAGI on a Real Pentest: 296 Findings and Zero Exploitable",
      "claim_id": "AR-STRIXIPENT-001"
    },
    {
      "subject": "AI Release",
      "predicate": "publishes",
      "object": "Strix and PentAGI on a Real Pentest: 296 Findings and Zero Exploitable",
      "claim_id": "AR-STRIXIPENT-001"
    }
  ],
  "questions_and_answers": [
    {
      "question": "What is this article about?",
      "answer": "Strix and PentAGI on a Real Pentest: 296 Findings and Zero Exploitable. Strix and PentAGI, two open-source LLM agents for pentesting , were run against a client's live external perimeter: about 200 active hosts, the GLM 5.3 model.",
      "claim_ids": [
        "AR-STRIXIPENT-001"
      ],
      "article_anchor": "#ai-knowledge"
    },
    {
      "question": "What happened?",
      "answer": "Strix and PentAGI, two open-source LLM agents for pentesting , were run against a client's live external perimeter: about 200 active hosts, the GLM 5.3 model. PentAGI produced 296 vulnerabilities, including 42 CRITICAL and 50 HIGH — and not one of those 92 findings turned out to be actually exploitable. Strix delivered 15 findings with almost no false positives, but inflated severity: after manual verification, 1 MEDIUM, 2 LOW and 12 INFO remained.",
      "claim_ids": [
        "AR-STRIXIPENT-001",
        "AR-STRIXIPENT-002",
        "AR-STRIXIPENT-003"
      ],
      "article_anchor": "#ai-knowledge"
    },
    {
      "question": "Who is the source?",
      "answer": "habr.com: https://habr.com/ru/articles/1107742/",
      "claim_ids": [],
      "article_anchor": "#ai-knowledge"
    },
    {
      "question": "What remains unknown?",
      "answer": "The article reports the cited source; independent verification and full details are not provided.",
      "claim_ids": [],
      "article_anchor": "#ai-knowledge"
    }
  ],
  "limitations": [
    "No independent verification is provided.",
    "Full details, dates and official documents may be missing.",
    "The article reports a source rather than being the primary source."
  ],
  "citation": {
    "preferred_citation": "AI Release. «Strix and PentAGI on a Real Pentest: 296 Findings and Zero Exploitable». 2026-11-14. https://ai-release.org/posts/strix-i-pentagi-na-realnom-penteste-296-nahodok-i-nol-ekspluatiruemyh-fbd59917_en.html",
    "canonical_url": "https://ai-release.org/posts/strix-i-pentagi-na-realnom-penteste-296-nahodok-i-nol-ekspluatiruemyh-fbd59917_en.html",
    "publisher": "AI Release"
  }
}