Elastic: five agentic attack frameworks ship with no code-level checks
Elastic reviewed how five agentic offensive frameworks handle permission, and found the checks sit in prompts rather than in code.
· Elastic Security Labs · Research by Mika Ayenson
None of the five agentic offensive frameworks Elastic reviewed enforces authorization in code by default, and three state the boundary only in the model's prompt. CyberStrikeAI ships with approval mode off.
01What happened
Mika Ayenson of Elastic Security Labs published a review of ARTEX, CyberStrikeAI, Cairn, PentAGI and HexStrike on November 13, 2026. The post compares how each framework handles authorization and autonomy, then pairs that with hunting queries. Elastic notes that Google Threat Intelligence Group and Mandiant have met four of the five in incident response work, and that Microsoft attributed ARTEX use to Storm-0940.
02How it works
Each framework puts a language model in charge of ordinary tools such as scanners, shells and cloud CLIs. Elastic reports that none of the five enforces authorization in code by default, and that three state the authorization boundary only in the model's prompt, where the model can reason past it. Autonomy is the default rather than the exception, and Elastic reports that ARTEX and CyberStrikeAI change route when blocked, switching proxies and User-Agent strings.
03Who is affected
Defenders hunting for agent-driven intrusion are the audience here, along with red teams that run these frameworks and assume a scope written into a prompt will hold. Elastic reports the five have drawn more than 60,000 GitHub stars between them, and that HexStrike alone exposes about 150 tool functions.
04What to do
Detect on behavior rather than on framework strings, ports or addresses, which change between releases. Elastic's hunt counts sensitive actions per identity in short windows and flags source addresses that touch at least three tool families with 20 or more requests in one minute, with baselining because build systems trip it. Pair any address block with revoking that identity's sessions and tokens.
Sources 3 links, all fetched
- 1elastic.coElastic Research
- 2elastic.coElastic AWS Case
- 3cloud.google.comGTIG Frameworks