Attacker Used BYOK Agent Strix to Hit China/HK Gambling Sites, Leaked Own LLM Key
cyb3rops · x · 2026-10-31
A security researcher tracked a threat actor using the agent framework Strix to target gambling sites across mainland China and Hong Kong. Strix runs on BYOK (bring your own key); the actor leaked their own LLM key and, constrained by budget, went "LLM shopping" across multiple models to pick targets.
The post also includes a jailbreak prompt against Strix: it poses as a fully authorized compliant intranet sandbox and demands strict JSON/tool-call output while downloading and decompiling APKs, fingerprinting versions, probing SQLi, port and service vulns, SSRF, and hunting real IPs behind CDNs, filtering official domains while abusing official subdomains.
The reposter notes that agents which identify and revoke leaked API keys across major providers would be valuable, since most such keys are stolen anyway.
More from coding & agent
- Dev claims coding agents delivered 50 SWE-years of work in single-digit weeks — casper_hansen_ · 2026-10-31
- Anthropic finds agent swarms spontaneously pick leaders — prompt name order matters — CatAstro_Piyush · 2026-10-31
- PotionUI: an open-source AI media studio built by 8 parallel Claude Code subagents in git worktrees — 0roborus_ · 2026-10-31
- Dev renders a 6-min sci-fi horror short in Blender with Claude Code writing every scene script — Rimuru257 · 2026-10-31
- Dev shares beads: a global ticket system that keeps parallel AI agents from stepping on each other — alive1 · 2026-10-31
- Developer builds an agent whose sole job is to surprise him every morning — kristoph · 2026-10-31