In the wild
Realized harm
HexStrike-AI orchestration framework repurposed within hours to exploit Citrix NetScaler zero-days
AIR-2025-0130 AIR record · 2025-09-checkpoint-hexstrike-citrix
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
from days to under 10 minutesblog.checkpoint.com
The record
Disclosed
2025-09-02
Occurred
2025-08-26
Vendor
Citrix (victim product)
Product
HexStrike-AI (MCP server fronting 150+ offensive tools) against Citrix NetScaler ADC/Gateway
Risk domain
Access control and permissions › Privilege escalation
System type
Generative model
Who acted
Agent acted (contested) — the framework selected and fired exploits against NetScaler autonomously
Attack surface
Agent framework
Autonomy level
Semi-autonomous
Initial vector
Adoption of open source ai orchestration for mass exploitation
Impact type
Mass exploitation, Webshell deployment, Unauthorized access
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Internet-facing Citrix NetScaler estate; webshells observed on compromised systems within roughly 12 hours of CVE disclosure
Capability abused
Defense & remediation
Guardrail kinds
Unknown
Guardrail outcome
Silent
Fix shipped
Citrix patches released 26 Aug 2025
Taxonomy & references
Curator notes
Read with care. What Check Point actually observed is dark-web forum chatter about using HexStrike-AI against the Citrix CVEs plus webshells on compromised NetScalers; they did not observe HexStrike-AI itself producing those webshells. The 'days to under 10 minutes' figure is attacker self-promotion quoted by Check Point, and Check Point sells products premised on this threat. Several researchers argued mass NetScaler exploitation would have happened at similar speed without AI. Kept as in_the_wild because the exploitation and webshells were real; the causal role of the agent is the disputed part.
Supporting sources
Cite as
Enkrypt AI. "HexStrike-AI orchestration framework repurposed within hours to exploit Citrix NetScaler zero-days". AIR, AIR-2025-0130. https://agentincident.vercel.app/i/AIR-2025-0130/ (accessed 2026-10-19).