# Elastic: five agentic attack frameworks ship with no code-level checks

> Elastic reviewed how five agentic offensive frameworks handle permission, and found the checks sit in prompts rather than in code.

- **Severity:** Info: Research, tools, evals or lab claims with no direct exposure. Context, not an alert.
- **Category:** Research, Attack
- **Published by:** Elastic Security Labs
- **Disclosed:** 2026-11-13
- **Affects:** ARTEX, CyberStrikeAI, Cairn, PentAGI, HexStrike
- **Research by:** Mika Ayenson
- **Primary source:** https://www.elastic.co/security-labs/threat-command/agentic-offensive-frameworks-detection-artex
- **Page:** https://theinjection.dev/items/elastic-agentic-frameworks-authorization-defaults/

None of the five agentic offensive frameworks Elastic reviewed enforces authorization in code by default, and three state the boundary only in the model's prompt. CyberStrikeAI ships with approval mode off.

## What happened

Mika Ayenson of Elastic Security Labs published a review of ARTEX, CyberStrikeAI, Cairn, PentAGI and HexStrike on November 13, 2026. The post compares how each framework handles authorization and autonomy, then pairs that with hunting queries. Elastic notes that Google Threat Intelligence Group and Mandiant have met four of the five in incident response work, and that Microsoft attributed ARTEX use to Storm-0940.

## How it works

Each framework puts a language model in charge of ordinary tools such as scanners, shells and cloud CLIs. Elastic reports that none of the five enforces authorization in code by default, and that three state the authorization boundary only in the model's prompt, where the model can reason past it. Autonomy is the default rather than the exception, and Elastic reports that ARTEX and CyberStrikeAI change route when blocked, switching proxies and User-Agent strings.

## Who is affected

Defenders hunting for agent-driven intrusion are the audience here, along with red teams that run these frameworks and assume a scope written into a prompt will hold. Elastic reports the five have drawn more than 60,000 GitHub stars between them, and that HexStrike alone exposes about 150 tool functions.

## What to do

Detect on behavior rather than on framework strings, ports or addresses, which change between releases. Elastic's hunt counts sensitive actions per identity in short windows and flags source addresses that touch at least three tool families with 20 or more requests in one minute, with baselining because build systems trip it. Pair any address block with revoking that identity's sessions and tokens.

## Quick facts

- **Frameworks:** ARTEX, CyberStrikeAI, Cairn, PentAGI and HexStrike
- **Authorization:** None enforce it in code by default; three state it only in the model's prompt
- **Default autonomy:** CyberStrikeAI ships with approval mode off
- **Reach:** More than 60,000 GitHub stars combined
- **Development pace:** About 390 ARTEX commits in roughly ten and a half weeks; over 2,400 CyberStrikeAI commits in its first year
- **Found by:** Mika Ayenson, Elastic Security Labs

## Sources

1. [Elastic Research](https://www.elastic.co/security-labs/threat-command/agentic-offensive-frameworks-detection-artex)
2. [Elastic AWS Case](https://www.elastic.co/security-labs/threat-command/cyberstrikeai-aws-cloudtrail-intrusion)
3. [GTIG Frameworks](https://cloud.google.com/blog/topics/threat-intelligence/artex-and-friends-enter-agentic-offensive-frameworks)