Countering Threats in the Era of Agentic Attacks

AI pentesting frameworks like ARTEX and CyberStrikeAI compress intrusions from days to minutes. The techniques are the same. The clock is different. Here is what to look for, how to detect it, and why in-stream evaluation matters.

In this report

• What AI pentest frameworks are and what changed
• The behaviors and artifacts they leave in logs
• Detections and hunts you can implement
• Why in-stream detection and autonomic response close the gap
• Abstract detections for agentic attack activity
• Deception as defense ideas
• Hardening guidance

Introduction

Until recently an "AI-assisted attack" usually meant a more convincing phishing email. That changed in the past year with the rise of AI pentesting (AIPT) tools like ARTEX and CyberStrikeAI. These open-source frameworks compress the time it takes to probe target infrastructure, identify pathways in, and execute actions on objectives. No operator at the keyboard for most of it.

The techniques have not changed. It is the same SQL injection, the same password spraying, the same Kerberoasting, the same web shells we have been writing detections against for a decade. What changed is how fast those techniques get chained together, and how many targets one operator can run at once. Intrusions that used to unfold over days now finish in hours, minutes even.

In the era of agentic attacks, these three things matter most:

Harden the infrastructure first

Most agentic campaigns get in through an exposed management interface, an unpatched app, a long-lived credential, or a weakly authenticated side system. Agents find the weaknesses you already know about faster than you can get to them.

Detect at the speed the attack moves

A detection that fires on a schedule fires after the session is over. The speed at which these frameworks achieve their goals demands detection and response that keeps pace.

Act without waiting for a human

Detections should feed response automatically where possible. Abstract provides in-stream detection, agentic triage, and autonomic responses to identify, triage, and respond as fast as the attack moves.

What an AI pentest framework is

Looking past the branding, these tools share a similar design. An operator supplies a target and a goal. A planner agent breaks that goal into steps, worker agents claim those steps and run a suite of tools to carry them out (nmap, curl, sqlmap, Impacket, a headless browser), and the results feed back into shared state so the planner can pick the next move. The loop runs until the goal is met. That rapid iteration and agent delegation is how these tools work so quickly.

They are all model-agnostic. When a frontier model refuses a request, the operator swaps in a more permissive one and carries on, so guardrails here are more like a speed bump than a wall.

Agentic frameworks have already been involved in a number of high-profile campaigns. Operators range from lone financially motivated individuals to state-aligned groups. Across intrusions the volume and timing of the attacks are the most interesting aspects: thousands of failed sign-ins within a short window, under three hours from first contact to privileged cloud access, and minutes from finding a secret in a public repository to pulling data out of a cloud secret store.

ARTEX went closed-source in October, but that did nothing to slow its use. It had been forked thousands of times by then. A number of maintained public forks are still out there with their own release pipelines, and rebrands under different names keep appearing. That matters because keyword-based detections relying on brand names like ARTEX have an increasingly short shelf life. We show how to build for the behaviors instead.

What it looks like in logs

These tools are loud, since they trade stealth for speed. You will usually have plenty of evidence, but reduced time to act on detected activity.

Indicators fall into two groups: tool fingerprints compiled into the software, and behavioral shapes the architecture produces regardless of configuration. Operators can modify the tools to suppress the former, but the underlying behaviors are far less likely to be changed.

Fingerprints

While these are better than ephemeral indicators like IPs, they are still attacker-controlled and subject to change in future framework versions and forks. Detect these, but complement with more robust detections on the underlying behaviors, covered in the next section.

‍

Behaviors

Machine cadence

Agents tend to form clusters of intense activity. Spray campaigns run with a median gap of about 1 second between attempts for 20 to 60 minutes.

Dependency chaining

The agent downloads a JavaScript source map or an OpenAPI spec, then minutes later starts calling internal API routes by name. Often these are routes that appear nowhere else on the site or do not follow a usual user navigation flow.

Adaptive error recovery

Agents adapt much quicker than humans and even scripts. Look for a failed request due to incorrect parameters, followed quickly by the same request returning success with parameters corrected.

Breadth before depth

Dozens of read-only API calls in seconds to map what a credential can reach before touching anything: permission probing with dry-run flags, test blobs written and deleted in under half a second.

Client identity rotation

Many AIPT frameworks rotate user agents and other request headers between bursts of activity. A series of requests coming from the same client with different user agents is usually not legitimate.

Relentlessness

Look for client sessions running for hours without a pause, new source addresses within minutes of a block, and variations tried after a failure instead of a stop.

Disposable tooling on disk

An agent writing a web shell rarely gets it right the first time, so it writes one, runs it, reads the error and rewrites it. What that looks like is a burst of near-identical variants with throwaway names, often in the web root. This same behavior can produce probe files with assorted extensions while the agent works out where it can write.

Real-time cleanup

Agentic attacks can be surprisingly tidy. Look for anti-forensic activity: staging files shredded, timestamps forged, and log lines removed while the work is still going on.

Anomalous outbound traffic

Look for network activity or commands posting output to rotating webhook and request-capture services, and LLM API calls coming from a server. A host unexpectedly connecting out to a webhook service, an inference endpoint, or an unfamiliar model gateway is a good hunt regardless.

Detection approaches

These are written as pseudo-logic so you can build them wherever your telemetry goes. Some are high-fidelity and can be alerted on depending on the environment; most are for hunting. Web-source detections are most effective if you know your applications and what usual user traffic looks like.

Detection is one part of the solution. To match the speed of agentic attacks, implement response actions against agentic attack clients and suspected compromised accounts or endpoints. Better yet when triage time between detection and response is just as fast as the attack. That is where Abstract comes in, but first the detections.

Framework UA fingerprints

‍

UA fingerprints from scanners invoked by the frameworks

‍

Credential attacks that succeed

Classic password spray

Web application clients that post straight at the authentication endpoint and never request a login page (POST but no prior GET)

‍

UA rotation from same source IP

‍

UA rotation from same TLS client fingerprint

‍

Requests with no UA

‍

Adaptive error recovery

‍

API surface retrieval followed by enumeration

‍

High rate of distinct failed API calls in cloud

‍

Secrets listing burst in cloud

Will likely need to tune out CI/CD roles and services, though they aren’t out of reach of compromise

‍

Execution velocity on the endpoint

‍

Script files appearing in a web root

‍

Host enumeration followed by suspicious actions

‍

Abstract detections in-stream

An agent can enumerate, stage a tool, write persistence, and clean up within minutes, so a detection on a schedule reports history while an attacker is already executing actions on objectives. Abstract evaluates rules in the event stream and enriches in pipeline, reducing mean time to detect and facilitating much faster response. We pair fast detections with autonomic responses to hinder attacks as fast as possible.

Autonomic response

Abstract pairs agentic attack detections with a bounded response in the same stream. High-confidence findings or correlated activity can be configured to update WAF rules and block malicious clients automatically. Other approaches range from rate limiting and tarpits to host isolation. Response actions can check against protected lists to ensure only resources in scope are affected.

Abstract customers can look for analytics that integrate with WAF rules.

In AWS WAF, as an example:

• AWS WAF - Agentic AI Attack Detected
• AWS WAF - Single JA3 Presenting Multiple Chrome User Agents
• AWS WAF - User Agent Rotation From Single TLS Fingerprint
• AWS WAF - Sensitive Path Probe via Direct Origin Host
• AWS WAF - Out-Of-Band Callback Domain In Request

Abstract detections

Abstract provides analytics built directly against the fingerprints and behaviors above. These are available to customers now:

• AI Pentest Framework Artifact File Created
• Web - AI Pentest Framework User Agent
• Web - Offensive Tool User-Agent
• Web - Burst of Requests Without a User Agent
• Web - Scanner User Agent Rotation Among 404 Responses
• Web - API Surface Retrieval Correlated with Endpoint Enumeration
• Windows - Rapid Creation of Script Files in a Web Root
• Linux - Rapid Creation of Script Files in a Web Root
• Linux - Web Server Compromise Correlated with Anti-Forensics on the Same Host

Here are other analytics customers can leverage for detecting agentic attacks:

• Abstract Amplify ATT&CK Chain - Reconnaissance to Exploitation and Execution (source_address)
• Abstract Amplify ATT&CK Chain - Discovery to Exfiltration (source_address)
• Abstract Amplify ATT&CK Chain - Discovery to Exfiltration (user_name)
• AWS - IAM Enumeration + Policy Modification + Credential Adjustment
• Linux/macOS - Multiple Anti-Forensics Techniques Detected
• Linux - Timestomping via debugfs
• Linux - File Deletion via Shred
• Linux - Syslog Log Clearing
• Linux - Web Server Process Spawning Suspicious Shell Command
• Linux - Suspicious Confluence Child Process
• Windows - Suspicious Confluence Child Process
• Web - Request to Cloud Instance Metadata Endpoint (Possible SSRF)
• AWS ALB - Credential Stuffing Against an Authentication Endpoint
• AWS ALB - Path Enumeration Sweep From a Single Source
• AWS CloudTrail - Machine Speed Denied API Enumeration Sweep
• AWS CloudTrail - DryRun Capability Mapping Burst
• Azure EventHub - Multi Provider Credential Listing Burst
• Azure EventHub - Key Vault Access Policy Self Grant and Revert
• Azure EventHub - App Service Configuration Secrets Listed
• GCP - Offensive security tool user agent observed
• GitHub - GitHub Secret Scanning Alert Created
• Okta - Password Spray (Low and Slow)
• M365 Impossible Travel Activity Alert
• Microsoft Graph API Successful Credential Stuffing
• Network - Webhook Website Communication
• Graph API Service Principal Credential Update
• Graph API Add Delegated Permission Grant with Hidden Consent Grant Permission
• GenAI - Programmatic API Access to GenAI Service
• GenAI - Unsanctioned AI Service Access

Deception as defense

Decoys can work particularly well against agents. Autonomous tooling enumerates exhaustively by design since it tends to check everything in scope. Threat actors pay for AI usage, so why not waste their time and money?

• Misleading comments in source files. Plant comments in HTML and JavaScript that point to nonexistent paths and juicy-sounding but fake vulnerable endpoints. Describe bogus function parameters, list fake API endpoints, and even get the agent to calculate prime numbers. Give the agent the scenic route to your application.
• Digital purgatory for confirmed agentic clients. Send them endless decoy pages, massive response payloads, and fake invalid session cookies. Route agents to parallel, near-duplicate application instances that aren’t hooked into anything real and ultimately lead nowhere. These techniques tend to work better than blocking outright, as most operators will have many hosts at their disposal, and blocking can tell an agent where it is definitely not supposed to go.
• Canary accounts and secrets. Create canary accounts and credentials to use as detection tripwires when they show up in logs as being used or enumerated. These can be planted or hinted at different depths — from source maps, JS bundles, and public repos to internal accounts, roles and secrets stores. However, ensure that the canaries themselves don’t open up attack paths to real resources.
• Fake wins. Present convincing evidence the objective is already met so the agent stops on a false success or contaminates the operator report. Plant at the reconnaissance surface before the agent has verified a real path, since evidence has to match a hypothesis it is already pursuing, survive a couple of cheap checks, and leave a coherent next step.
• Control the narrative. Stage documentation or fake pentest reports that label select, real assets as canaries, which can dissuade the agent from pursuing actual resources. This one’s the more experimental of the bunch and should be balanced so as not to inadvertently help agents by revealing resources.
• Make them pay in compute. Planting a fake passwords.txt on a file server is one thing, but how about sending the agent on a password cracking adventure? Stage fake encrypted archives that seem worth the agent’s effort like db_backup_06112026.tar.gz. Altogether they can form a trove of fake data the agent tries to get to, where initial archives have easy-to-crack passwords while subsequent ones take much longer.

For many of these approaches there is a caveat. If an agent already identifies a real target, it’s far less likely to follow decoy paths. The point is that none of these are substitutions for attack surface reduction, vulnerability management, and proper patching at a high cadence.

Hardening guidance

Detection buys you time. These reduce what an agent can do with the time it has.

Kill long-lived credentials

Move away from static cloud access keys, application client secrets, and classic personal access tokens in favor of short-lived/JIT credentials and federated identities. Rotate anything older than a year while you are at it, as AIPT frameworks are exceptional at finding exposed creds.

Constrain where a credential works, not just what it reaches

A service principal built for an internal CI runner should not authenticate from arbitrary external infrastructure.

Get management interfaces off the internet

Cloud consoles, admin APIs, firewall and VPN management, hypervisors, CI/CD, backup platforms, application publishing endpoints. Agents are very good at finding a reachable admin path and testing what it allows.

Isolate non-production, or run it like production

Internet-exposed staging environments sharing credentials, tokens, or network paths with production have been a repeated entry point. Alert on any access from a non-production system to a production one.

Turn down the error detail you return to strangers

Stack traces, SQL errors, and framework internals are troubleshooting aids for you and a feedback loop for an agent, which can correct its next request in seconds with a good error message.

Put limits on business functions that scale

Anything that sends mail or notifications, creates users, changes access, or moves money needs rate limits, recipient limits, and thresholds. One intrusion deployed no malware at all and used an application's own notification feature to mail hundreds of internal users.

Assume reconnaissance is exhaustive, not sampled

AI agents will find every subdomain, every exposed endpoint, every credential in git history, every open port. Don’t rely on obscurity for any layer of defense. Audit your external footprint assuming the attacker has already enumerated all of it.

Treat documentation as attack surface

Public runbooks, architecture diagrams, onboarding guides, OpenAPI/Swagger specs, and verbose HTTP headers (X-Powered-By, Server) give an AI agent a map of your environment. It can synthesize these into an attack plan faster than your team wrote them. Strip what you can; gate the rest behind authentication.

Assume the agent reads everything it touches

Unlike a human who skims, an AI agent can process and extract value from every file, database row, and config it can access. Treat any data accessible to a compromised identity as pivot leverage and potentially exfiltrated. This changes your blast radius scoping. The principle of least privilege matters more than ever.

Pre-authorize containment

Decide in advance which actions can be taken against which assets under which conditions, because a containment decision that needs a meeting arrives after the agent has finished.

Conclusion

What has changed is the clock, not the tradecraft. An agentic intrusion runs the same playbook your detections were built for, compressed into a window most detection and response programs were never designed to operate inside, against whichever weakness you had not gotten to yet.

So the work is less exotic than the headlines suggest. Close the exposures that let an agent in, detect the underlying behaviors its architecture cannot hide, evaluate those detections against events as they arrive rather than on a timer, and decide in advance how far you are willing to let the platform act on them without you.

References

• Microsoft Security Blog — Storm-0940 Uses ARTEX Agentic AI ConnectWise Supply Chain Compromise
• Microsoft Security Blog — ARTEX Abuse Expands as Cybercriminals Target Financial Sector
• Google Threat Intelligence Group — ARTEX and Friends: Enter Agentic Offensive Frameworks
• Wiz — ARTEX in the Wild: Storm-0940 Expands Targeting of IT and Software Vendors
• CERT-In — CIAD-2026-0058
• iZoologic — ARTEX Agentic AI Behind South Korea / Japan Campaigns
• Censys — ARTEX Agentic Asbestos
• Gambit Security — Autonomous AI Agents vs. Online Retailers
• Theori — Inside the AI Pentesting Tool Threat: An ARTEX Case Study and Defense Guide
• theori-io/aipt-detections (GitHub)
• Tracebit Research — Making Attacking Agents Pay with Context Bombs
• arXiv — AgentSnare: Learning to Delay, Divert, and Defuse Autonomous Web Penetration Agents

‍