Skip to content
NewA calmer, faster ZeroHour
Researchhigh

Five agentic offensive frameworks seen in real intrusions

Original title: Inside the loop: Five AI attack frameworks that never ask permission

Elastic Security Labsby Mika Ayenson ()13 min read
Read at elastic.co
Part of a story covered by 12 sourcesFBI warns ARTEX is automating intrusions; forks and consoles remainMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

GTIG and Mandiant saw ARTEX, Cairn, HexStrike, and PentAGI in incidents; Microsoft links ARTEX to Storm-0940.

Elastic Security Labs reviewed ARTEX, CyberStrikeAI, Cairn, PentAGI, and HexStrike, five agentic offensive frameworks with more than 60,000 GitHub stars combined. Each puts a language model in a planning loop over scanners, shells, and cloud tools, and none enforces authorization in code by default. Google Threat Intelligence Group and Mandiant have seen four of them in incident response, and Microsoft has attributed ARTEX use to Storm-0940. Action bursts can occur every two to 25 seconds.

Unconfirmed: NorForge assessed exposed Cairn panels as malicious; that assessment is not independently confirmed here.

Key facts
  • CyberStrikeAI ships with approval mode off and can build implants and C2 listeners.
  • PentAGI’s Compose file sets ASK_USER to false.
  • HexStrike exposes about 150 tool functions over MCP and has no own model.
  • ARTEX’s browser extension records an operator’s authenticated session for its agents.
  • Default target limits are blocklists for government and education domains.
Security assessment · AI, from the article

Impact: Automated intrusion actions through shells, implants, and cloud tools

What to do
  1. 1.Anchor detections on process, web, API, and sign-in behavior rather than framework fingerprints.
  2. 2.Select containment detections in advance because steps can take effect seconds apart.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
ATT&CK
T1059 Command and Scripting InterpreterT1505.003 Web Shell
Tags
artexcyberstrikeaicairnpentagihexstrikeagentic-attacks
Threat actors
Storm-0940
Malware
ARTEXCyberStrikeAICairnPentAGIHexStrike
Organizations
Google Threat Intelligence GroupMandiantMicrosoft

From the original article

13 min read at elastic.co

Five agentic offensive frameworks act in bursts of two to 25 seconds, and none enforces authorization in code. What ARTEX, CyberStrikeAI, Cairn, PentAGI, and HexStrike leave in your telemetry, and the ES|QL hunt that catches them.

Elastic Security Labs

By Mika Ayenson · elastic.co

Read the full article at Elastic Security Labs

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.