Threat Actors Weaponize HexStrike AI to Exploit Citrix Flaws Within a Week of Disclosure

Threat actors are attempting to weaponise HexStrike AI, a newly released open‑source AI offensive security tool, to exploit recently disclosed security flaws. HexStrike AI, according to its website, is pitched as an AI‑driven platform to automate reconnaissance and vulnerability discovery, aimed at red teaming, bug bounties and CTF challenges.

Per information shared on its GitHub, the platform integrates with more than 150 security tools to support network reconnaissance, web app testing, reverse engineering and cloud security, with dozens of AI agents fine‑tuned for vulnerability intelligence and exploit development.

Disclosures from Check Point indicate that threat actors are trying to use the tool to gain an adversarial advantage and weaponise it to exploit the three Citrix flaws disclosed last week, with some users reportedly flagging vulnerable NetScaler instances for sale on darknet forums. According to Check Point, the use of such tools can shorten the window between public disclosure and mass exploitation and automate exploitation efforts, while the immediate priority remains patching and hardening affected systems.

Researchers from Alias Robotics and Oracle highlighted additional prompt injection risks in AI‑powered security agents, underscoring broader concerns about unsafe deployment of these tools.