{
 "public_id": "AIR-2025-0130",
 "incident_id": "2025-09-checkpoint-hexstrike-citrix",
 "date_disclosed": "2025-09-02",
 "date_occurred": "2025-08-26",
 "title": "HexStrike-AI orchestration framework repurposed within hours to exploit Citrix NetScaler zero-days",
 "class": "in_the_wild",
 "attack_surface": "agent_framework",
 "initial_vector": "adoption_of_open_source_ai_orchestration_for_mass_exploitation",
 "agent_capability_abused": [
  "mcp_tool_orchestration",
  "autonomous_exploit_selection",
  "parallel_scanning",
  "adaptive_retry"
 ],
 "target_product": "HexStrike-AI (MCP server fronting 150+ offensive tools) against Citrix NetScaler ADC/Gateway",
 "target_vendor": "Citrix (victim product)",
 "autonomy_level": "semi_autonomous",
 "impact_realized": true,
 "impact_type": [
  "mass_exploitation",
  "webshell_deployment",
  "unauthorized_access"
 ],
 "blast_radius": "Internet-facing Citrix NetScaler estate; webshells observed on compromised systems within roughly 12 hours of CVE disclosure",
 "cve": [],
 "taxonomy": {
  "owasp_asi": [
   "ASI05",
   "ASI03"
  ],
  "mitre_atlas": [],
  "labels": [
   "agentic_offense",
   "time_to_exploit_collapse",
   "mcp_orchestration"
  ]
 },
 "defense_present": null,
 "defense_bypassed": null,
 "fix_shipped": "Citrix patches released 26 Aug 2025",
 "primary_sources": [
  "https://blog.checkpoint.com/executive-insights/hexstrike-ai-when-llms-meet-zero-day-exploitation/"
 ],
 "verified_quote": "from days to under 10 minutes",
 "confidence": "high",
 "notes": "Read with care. What Check Point actually observed is dark-web forum chatter about using HexStrike-AI against the Citrix CVEs plus webshells on compromised NetScalers; they did not observe HexStrike-AI itself producing those webshells. The 'days to under 10 minutes' figure is attacker self-promotion quoted by Check Point, and Check Point sells products premised on this threat. Several researchers argued mass NetScaler exploitation would have happened at similar speed without AI. Kept as in_the_wild because the exploitation and webshells were real; the causal role of the agent is the disputed part.",
 "risk_category": "security_fraud",
 "risk_secondary": [],
 "risk_subcategory": "Tool & Function Call Extraction / Abuse",
 "risk_sub_secondary": [
  "Unauthorized Access & Account Takeover"
 ],
 "ai_entity": "generative",
 "agency": "agent_acted",
 "agency_debatable": true,
 "agency_reason": "the framework selected and fired exploits against NetScaler autonomously",
 "vector_family": "conventional_vulnerability",
 "vector_detail": "adoption_of_open_source_ai_orchestration_for_mass_exploitation",
 "guardrail_kind": [
  "unknown"
 ],
 "guardrail_outcome": "silent",
 "xrefs": {
  "aiid": [],
  "atlas": [],
  "cve": [],
  "ghsa": []
 },
 "primary_asi": "ASI05",
 "agent_framework": "mcp_server",
 "model_provider": "unknown",
 "model_name": "",
 "detection_mechanism": "threat_intel",
 "tool_access": "unknown",
 "financial_loss_band": "unknown",
 "eai_category": "privilege_escalation",
 "eai_domain": "access_control_and_permissions",
 "eai_secondary": [],
 "eai_reason": "impact rule: privilege_escalation",
 "asi_curated": [
  "ASI05"
 ],
 "asi_scope": "in_scope",
 "asi_provenance": "curated_plus_rule",
 "asi_reason": "curated: ASI05 | added ASI03 (signal=identity)",
 "submitted_by": "EAI Internal"
}