Malware · 17h ago
Elastic Security Labs examined five agentic offensive frameworks—ARTEX, CyberStrikeAI, Cairn, PentAGI and HexStrike—and found that none enforces authorization in code. Google Threat Intelligence Group and Mandiant have observed four in incident-response engagements, while Microsoft attributed ARTEX use to Storm-0940.
The frameworks put an AI model in charge of familiar scanners, shells and cloud tools. Scope limits may be written as instructions for the model, but code does not ensure those limits are followed. The resulting activity still appears as processes, web requests, API calls and sign-ins. Elastic says ARTEX and CyberStrikeAI can also change routes when blocked, making framework fingerprints and source addresses less durable clues.
If your detections depend on source addresses or User-Agent strings, route changes can erase those clues; the underlying process, request, API call or sign-in is more durable in the telemetry you collect. For teams running authorized exercises, stated scope alone does not guarantee the tools stay within it.
1 source covering this story
Agentic offensive frameworks: Detecting ARTEX and 4 more
We read the source of five agentic offensive frameworks.
Part of the PlainSec briefing for 2026-11-14