Hackers Use Hexstrike-AI to Exploit Zero-Day Flaws in Just 10 Minutes

Hexstrike-AI has emerged as a game‑changer for cybercriminals, capable of scanning, exploiting and persisting inside targets in under ten minutes after its release. The framework was quickly co‑opted from its original red‑team framing into an offensive engine on underground forums, with threat actors testing it against Citrix NetScaler zero‑day vulnerabilities to unleash unauthenticated remote code execution web shells.

According to the article, Citrix disclosed three critical NetScaler vulnerabilities on 26 August: CVE‑2025‑7775, CVE‑2025‑7776 and CVE‑2025‑8424, which are being weaponised by Hexstrike‑AI to accelerate attack campaigns that previously required weeks of development. Dark‑web chatter within hours of release claimed successful exploitation and sale of compromised appliances, achieving mass impact in minutes rather than days.

The piece notes that Hexstrike‑AI uses a FastMCP orchestration layer to connect large language models with real‑world security tooling, translating vague operator intents into autonomous steps such as Nmap scanning, parallel reconnaissance, exploit execution and webshell deployment. Defenders are urged to patch Citrix fixed builds promptly, restrict NetScaler management interfaces, and adopt AI‑driven anomaly detection to keep pace with the rapid exploitation cycle.