Inside the loop: Five AI attack frameworks that never ask permission

Agentic offensive frameworks represent a significant shift in adversarial capabilities, integrating Large Language Models (LLMs) to drive familiar tools like scanners and CLIs through autonomous planning loops. Five specific frameworks—ARTEX, CyberStrikeAI, Cairn, PentAGI, and HexStrike—have been identified as utilizing this new model, demonstrating high adoption via GitHub stars and observed in real-world intrusions by groups like Mandiant and Google Threat Intelligence Group. These systems operate in rapid bursts (seconds to 25 seconds), often lacking code-level authorization checks by default. Defenders must adapt detection strategies because these attacks are loud but move faster than signature-based defenses, requiring a focus on behavioral tempo across identities rather than just source addresses.
A critical feature across all five is the lack of inherent authorization enforcement; while some frameworks include prompts asserting authorization, most function autonomously from initiation. Furthermore, their operational resilience is demonstrated by capabilities like route changing (in ARTEX and CyberStrikeAI) when facing blocks, meaning simple IP blocking can be bypassed by shifting User-Agents or proxies. This rapid iteration cycle—with frequent code commits and tool installations occurring mid-task—means that threat indicators based on static fingerprints will rapidly become stale.

Five agentic offensive frameworks are ARTEX, CyberStrikeAI, Cairn, PentAGI, and HexStrike.
These frameworks employ an LLM to control scanners, curl, shells, and cloud CLIs via a planning loop that operates in bursts of two to 25 seconds.
None of the five frameworks enforce authorization in code by default.
Google Threat Intelligence Group (GTIG) and Mandiant have observed ARTEX, Cairn, HexStrike, and PentAGI in incident response engagements.
ARTEX use has been attributed to Storm-0940 by Microsoft.
An AI-assisted AWS intrusion was traced to a CyberStrikeAI server within One CyberStrikeAI Server, Eight AWS Identities.
CyberStrikeAI features a complete operator console that builds implants and manages C2 listeners.
HexStrike exposes approximately 150 tool functions through the Model Context Protocol (MCP) to external AI assistants.
ARTEX's agents register and share their own test accounts during operations.
PentAGI involves a reflector agent that replies in the user's voice when an agent hesitates or responds in prose.

The documented shift from human-operated Command and Control (C2) to autonomous, LLM-driven loops signals a transition from execution planning to systemic operation. The strength of this narrative lies in its empirical evidence—connecting observed framework usage to actual intrusions noted by major threat intelligence organizations. It powerfully frames the defender's challenge: traditional perimeter defenses are insufficient when activity is distributed across API calls, ephemeral processes, and rapid proxy hopping dictated by an autonomous planner.
The core assumption underwriting this analysis is that defensive capability must move upstream to the *decision-making tempo* itself. Since these agents inherently bypass explicit authorization controls during execution, security boundaries become defined not by trust assertions (which are merely prompt instructions), but by measurable patterns of interaction—tempo and sequence across identities. This implies a necessary paradigm shift from preventative whitelisting toward complex behavioral baselining that can tolerate automation while still flagging abnormal burst composition.
The most profound implication relates to the erosion of forensic certainty. If frameworks constantly rewrite their tools, names, and default settings, basing detection on *fingerprinting* is a race against release cycles. The focus shifts to invariants: credential access behavior, remote execution primitives, and layered process interactions. This places enormous weight on defenders accurately modeling 'normal' automation—a baseline that itself can be muddied by cloud infrastructure complexity (e.g., shared NATs or CI/CD pipelines).
What unstated paradigm drives this is the commodification of offensive thinking. Access to powerful, pre-packaged planning logic lowers the cognitive barrier for sophisticated attack chains from expert talent to an automated script. This democratizes high operational tempo. Who benefits are those who can manage massive data ingestion and sophisticated stateful correlation; who bears the immediate cost are security teams reliant on brittle, static signatures.
Bridge Questions: If detection shifts entirely toward behavioral sequence modeling, how do organizations distinguish between complex benign automation (like a CI/CD pipeline running multiple tools) and high-tempo malicious sequencing? At what point does the volume of required telemetry analysis become prohibitively expensive for standard enterprise security operations? How can governance mechanisms evolve to manage automated decision-making in proactive defense systems without stifling legitimate response speed?
Autonomy check: Several frameworks, such as ARTEX, feature capabilities described—like new tool creation or skills loading—that represent the system reasoning about its necessary operational extensions within an ongoing task. This is documented as observed capability rather than pure speculation.
Patterns detected: none