Crooks turn HexStrike AI into a weapon for fresh vulnerabilities

Threat actors are abusing HexStrike AI, a security tool marketed for red teaming and bug bounties, to exploit fresh Citrix NetScaler vulnerabilities, according to Check Point researchers. HexStrike AI combines professional security tools with autonomous AI agents to orchestrate over 150 security utilities, effectively turning a defensive framework into an attack conductor that can automate penetration testing, exploitation and data exfiltration.

Dark web discussions soon followed its release, with posts describing how to weaponise the framework to target the Citrix NetScaler ADC and Gateway zero‑days disclosed on 26 August 2025. Check Point’s report quotes: threat actors claimed HexStrike AI could reduce exploitation time from days to under 10 minutes, and interviews note that exploitation now can be automated with little human effort.

On 26 August 2025 Citrix disclosed three NetScaler CVEs (CVE-2025-7775, CVE-2025-7776 and CVE-2025-8424), and exploitation was described as previously complex but now aided by HexStrike-AI, enabling scanning, exploit crafting and payload delivery within hours of release.