HEXSTRIKE-AIHexStrike AI

Open-source agentic AI penetration testing framework. Google Threat Intelligence Group and Mandiant report that multiple threat actors abused it, alongside ARTEX and CAIRN, in incident response engagements from late August 2026, to carry out actions across several phases of the attack lifecycle. Kaspersky places HexStrike AI and similar tools on the reconnaissance and exploitation ("find and break") side of the kill chain, as opposed to LLM-orchestrated post-exploitation C2 frameworks such as CyberStrikeAI. Neither source attributes its use to a named actor. Dual-use: its presence alone does not indicate malicious activity.