Five agentic offensive frameworks install with a single script or Compose file and have drawn more than 60,000 GitHub stars between them: ARTEX, CyberStrikeAI, Cairn, PentAGI, and HexStrike. All five have already turned up in intrusions rather than only in red team engagements. Google Threat Intelligence Group (GTIG) and Mandiant have observed ARTEX, Cairn, HexStrike, and PentAGI in incident response engagements, and Microsoft has attributed ARTEX use to Storm-0940.
Inside the loop: Five AI attack frameworks that never ask permission
About this summary. This is a short excerpt from the description that Elastic Security Labs published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://www.elastic.co/security-labs/threat-command/agentic-offensive-frameworks-detection-artex
Source attribution: headline and facts are from Elastic Security Labs (elastic.co). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
ARTEX AI Pentest Tool: What Security Teams Need to Know
ARTEX AI has moved from a GitHub research project to the engine behind some of the fastest-moving agentic AI cyberattacks of 2026. ARTEX is an autonomous penetration…
ARTEX and Friends: Enter Agentic Offensive Frameworks
Written by: Aurora Blum, David Mainor, Rohit Nambiar, Omar ElAhdan, Matthew McWhirt, Will Silverstone, Bhavesh Dhake, Chris Busse Introduction Recent intrusions in which…
Tracking AI adoption in North Korean threat actor tradecraft
Stages of AI adoption by North Korean threat actors AI use across North Korean threat operationsAI-assisted targeting and reconnaissance AI-assisted social engineering…
Federal agencies recommend cyber controls, independent testing for frontier AI systems
The federal government is advising AI companies to set more industry standards for securing agents in sandbox testing environments.
The Microsoft Outage Is a Warning for the World
Countless businesses, schools, hospitals, and governments have found out the hard way what it means to rely on a single company’s systems to get things done. And next…
XaocMail ClickFix Campaign Drops Phantom53 and HavoX Across Latin America, Asia, and Europe
Threat actors continue to refine and scale their operations, increasingly integrating artificial intelligence to harden attack infrastructure and accelerate deployment…