Researchers Uncover 45 AI Hacking Frameworks, With Hundreds of Attack Consoles Exposed on the Internet

Researchers have mapped 45 open-source frameworks that wire a large language model into a loop that runs offensive tools and acts on their output.

The catalog follows the takedown of ARTEX, an agentic penetration-testing platform. It shows the risk is spreading well beyond that single project.

The takedown did not stop the spread. ARTEX-named repositories and forks numbered 102 in the takedown week alone.

Google Threat Intelligence Group, Microsoft, Wiz, CrowdStrike, Zscaler, Check Point, Censys and RST Cloud have all covered ARTEX itself.

The researchers read the code of the remaining field and sorted 32 of the roughly 45 frameworks into five families. The other 13 are forks and variants that reuse a family’s pattern.

Network kill-chain tools handle reconnaissance through post-exploitation, usually from a Kali container. PentAGI runs agent teams with Nmap, Metasploit, and sqlmap.

RedAmon builds an attack-surface graph in Neo4j and attacks from a Kali sandbox with human approval gates. DarkMoon ships 50 specialist agents.

Git Guardian Researchers said that , ARTEX’s creator pulled the project on 2026-10-08, 74 days after its first commit. Reports said threat actors were using it to hunt for secrets and move laterally with them.

45 AI Hacking Frameworks

Web and API tools include Strix and Shannon, the latter closer to a SAST reviewer. C2-integrated projects such as Sage and echidna act as LLM operators inside Mythic. Pojun and FORANG are ARTEX derivatives that add a C2 console.

Harnesses such as RAPTOR and Cybermes wrap a general coding agent like Claude Code , Codex or Hermes with offensive skills. Research prototypes such as Incalmo and hackingBuddyGPT come from academic work.

Cairn, HexStrike and Agent Zero appear in threat reporting, and all three ship with no authentication by default.

The researchers graded a shortlist of tools on what they ship for finding secrets on public GitHub.

Four ship a real scanner wired to the agent: Pojun, Cybermes, Xalgorix and AIRecon. Pojun names gitleaks in its worker prompt.

Cybermes carries its own secret_scan binary with 48 regex patterns and nine read-only credential validators. None contains a GitHub fetcher.

That gap offers little comfort. Almost every framework hands its agent a shell and web access, so a GitHub or scanner download is one improvised tool call away.

The model and prompt supply the capability, and the repository does not have to.

Of the 41 frameworks fingerprinted for Shodan, 11 serve a web UI on a network port by default. Another 18 expose a UI only in some setups, and 12 have no listener.

The researchers wrote 56 fingerprint records. On 7 November 2026, the ARTEX family access alone matched 1,428 Shodan services.

PentAGI led the other tools with 419 services, 233 of them using its default certificate, mainly on ports 8443, 8666 and 8765.

Agent Zero followed with 173, of which 134 sat behind a login and 39 were open. ScopeWeaver showed 43, Cairn 41 and RedAmon 27. Xalgorix and Pojun exposed 6 and 11 on ports 9137 and 8787.

The risk concentrates in a handful of heavily forked bases, not in the most-starred repositories.

Strix, with 74.2k stars, showed no secret-hunting code, while Pojun, with 84 stars, ships a gitleaks-wired worker. Popularity is therefore a poor proxy for abuse potential.

The researchers published fingerprint descriptions rather than target lists. Defenders can use them to find their own exposed instances first.

Teams should check for agent consoles on the ports above, enforce authentication on any operator UI, and restrict outbound GitHub access from agent hosts.

Give your SOC the alert context on the latest threats to stop incidents quickly -> Integrate Threat Intel from 16K SOCs:

Artificial Intelligence

Cyber security Course

Cyber Security Resources

Cybersecurity

Information Gathering

Information Security Risks

Criminal IP Launches New TI Feed App on Splunkbase for Automated Threat Detection

Fortinet2Shell Vulnerability Lets Hackers Execute Code on FortiClient Systems Through Malicious Websites

N-able Warns of Critical N-central Zero-Day Vulnerability Actively Exploited by Hackers

BluePhishing Attack Abuses Microsoft Entra OAuth Consent to Create Hidden AI Agent Identities

Windows Active Directory RCE and DoS Vulnerabilities Put Windows Systems at Risk

Ivanti Patches Critical SQL Injection Flaw Allowing Remote Code Execution Without Login