Nice to see Strix hitting GPT-5.3 to finish those HTB machines. On our side we run Strix with --output commands.json and pipe that command list into a tiny replay harness before we accept a vuln. The harness replays each recorded HTTP request / shell command inside a sandbox, compares exit codes, and only the steps that reproduce the same signal survive the report. That keeps stray hallucinated CVEs out of the compliance narrative while letting the agent still explore freely. Have you tried re-running the recorded steps for the hits you liked best?

Wow, that's nice, you are way ahead of me! I haven't done any validation, but it wasn't needed for my tests. As I tested it against retired Hack The Box machines, I knew what should be reported and could also see if it found the flags. Your solution makes a lot of sense for using it in real work.