Strix integrates Vercel AI Gateway, opening access to 400+ models for security testing

What changes in Strix's configuration

Strix is described by Vercel as an open source tool for penetration testing of AI systems. Until the integration announced in Vercel's changelog, running Strix against a different LLM provider meant creating an account, generating a key, and adjusting environment variables specific to each one.

With support for the Vercel AI Gateway, that friction disappears. A single endpoint grants access to more than 400 models from providers such as Anthropic, OpenAI, Kimi (Moonshot AI), GLM (Zhipu AI / Z.ai), and Deepseek, with no markup on the price charged by each provider, according to Vercel.

In practice, the configuration comes down to two environment variables. STRIX_LLM now accepts an ID in the format vercel_ai_gateway/<provider>/<model>, and LLM_API_KEY receives the key generated in the AI Gateway dashboard, instead of a separate key per provider:

export STRIX_LLM="vercel_ai_gateway/zai/glm-5.3"
export LLM_API_KEY="your-ai-gateway-api-key"

Switching models no longer requires a new sign-up: just change the string after the vercel_ai_gateway/ prefix. Vercel also centralizes usage and cost tracking for all models used by Strix within the AI Gateway dashboard itself, which solves a concrete problem for anyone testing with several models at once: reconciling invoices from three or four different providers at the end of the month.

Why the model behind the pentest matters

AI penetration testing tools don't attack the target application on their own. They use an LLM as an attacking agent, which generates the prompt injection, jailbreak, and data exfiltration attempts later tested against the system under evaluation. That means the model chosen via STRIX_LLM isn't an infrastructure detail: it's part of the test's outcome.

In short: a model with stronger reasoning tends to find more sophisticated attack vectors, while a cheaper model works better for broad, repeated scans without blowing the budget. Having both types behind the same key makes it easier to switch between them depending on the test phase.

With direct access to Deepseek, Kimi, and GLM alongside Anthropic and OpenAI, security teams can compare how each model family behaves as an attacker without rewriting the integration for every new provider. This matters for anyone building production agents on models outside the Anthropic, OpenAI, and Google trio: if the agent runs on GLM or Deepseek, testing with an attacker from the same family makes sense, because models from one lineage tend to share certain instruction-following weaknesses.

What this solves and what remains manual

The integration solves credential friction, not test coverage. Switching providers without re-registering helps compare results between models quickly, but it doesn't by itself define which attack vectors to test or interpret the results.

Vercel's changelog doesn't detail which vulnerability classes Strix covers. Common categories in tools of this kind include prompt injection, excessive agent autonomy, and data leakage through tool calls, mapped in frameworks such as the OWASP Top 10 for LLM Applications. It's worth checking the project's own documentation before assuming full coverage for a specific case.

There's also a point of attention around cost and dependency:

• "No markup" applies to the price passed through by the provider via the Gateway; it doesn't guarantee it's the cheapest option in every scenario;
• Anyone who already negotiates volume discounts directly with a provider may not gain any savings by switching to the Gateway;
• Concentrating attacker and target on the same intermediary creates a single point of failure: an outage in the AI Gateway interrupts the entire security test, not just one production call.

The real gain here is operational (one key, one cost dashboard, one ID format), not necessarily financial.

Who benefits most from the change

Small security teams and devs who do AI pentesting on their own tend to feel the benefit most: they're the ones who pay the highest cost of managing multiple provider accounts just to compare models. Companies with a direct enterprise contract with a specific provider, with SLA and discounts already negotiated, gain less from the switch and may prefer to keep that provider's native integration for pentesting.

Anyone who already routes their own production agent's traffic through the Vercel AI Gateway gets a practical side effect: attacker and target show up in the same billing dashboard, making it easier to compare how much it costs to test the agent's security against how much it costs to run it day to day. Vercel points to the AI Gateway setup guide within Strix's documentation as a starting point for anyone looking to migrate their existing configuration.