Threat Actors Abuse Agentic Frameworks ARTEX and CAIRN for Automated Intrusions
Mandiant and GTIG observe ARTEX, Hexstrike, and CAIRN used by threat actors in live incidents since August 2026, enabling rapid lateral movement and exfiltration.
80
Product
PentAGI
- Mentions · 7d1
- Mentions · 30d4
- All mentions6
- First seenSep 11, 2026
- Last mentioned2d ago
Timeline
6 articles · newest firstCyberCartel used Claude and Grok against 400-plus financial firms
Straiker reviewed the group’s CARLIY0S system and a snapshot of 4,493 records, without confirming every target was breached.
76
CyberXero Combines Claude Code, PentAGI and Cobalt Strike in AI-Augmented Cyberattacks
CyberXero used Claude Code, PentAGI and Cobalt Strike to breach sites and steal Ukrainian data.
82
Russian-Speaking CyberXero Uses AI Agent Swarm to Attack Ukrainian Energy Infrastructure
CyberXero used WordPress exploits and Claude agents against Ukrainian energy targets, stealing hundreds of thousands of records.
84
Countering misuse of AI: September 2026 / Anthropic
Anthropic publishes threat intelligence on Claude misuse across seven harm areas from December 2025 through August 2026.
70
Hackers Use Claude AI Agents to Automate Cyberattacks, Develop 0-Days and Evade Detection
Anthropic reports state-sponsored and criminal actors used Claude AI agents to automate attacks, discover zero-days, and rewrite malware to evade detection.
82
Related CVEs
by mentions- CVE-2026-4815<1%8.7A SQL Injection vulnerability has been found in Support Board v3.7.7
Appears with
- Claudeai model · 4
- Anthropicvendor · 4
- SOCRadarorganization · 2
- Cobalt Strikemalware · 2
- WordPressproduct · 2
- Claude Codeproduct · 2
- Kharkiv district heating providervictim · 2
- GTG-20006threat actor · 2
- Anthropicorganization · 2
- Claudeproduct · 2
- WSOmalware · 2
- Magentoproduct · 2
- CyberXerothreat actor · 2
- Support Boardproduct · 2
- CAIRNproduct · 1
- Mythosai model · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.