Threat Actors Weaponize HexStrike AI to Exploit Citrix Flaws Within a Week of Disclosure

Sep 03, 2025Ravie LakshmananArtificial Intelligence / Vulnerability

Threat actors are making use of a newly launched artificial intelligence (AI) offensive security tool named HexStrike AI to exploit recently uncovered security vulnerabilities.

HexStrike AI, as per its official website, is designed to be an AI-driven security platform that automates reconnaissance and vulnerability discovery to hasten authorized red teaming operations, bug bounty hunting, and capture the flag (CTF) challenges.

Information revealed on its GitHub repository suggests that the open-source tool integrates with more than 150 security tools for network reconnaissance, web application security testing, reverse engineering, and cloud security. It also features several specialized AI agents optimized for vulnerability intelligence, exploit development, attack chain discovery, and error handling.

According to a report by Check Point, threat actors are now experimenting with the tool to gain an edge, trying to convert it into a weapon to exploit recently disclosed security flaws.

\”This represents a significant development: a tool meant to enhance defenses has been repurposed into a weapon for exploitation, solidifying earlier concepts into a widely accessible platform driving real-world attacks,\” the cybersecurity company stated.

Conversations on darknet cybercrime forums indicate that threat actors have claimed success in exploiting three security vulnerabilities disclosed by Citrix last week using HexStrike AI, and in some instances, even identifying seemingly vulnerable NetScaler instances that are then put up for sale to other criminals.

Check Point emphasized that the malevolent use of such tools has significant implications for cybersecurity, not only reducing the time between public disclosure and widespread exploitation, but also streamlining the automation of exploitation endeavors.

Furthermore, it minimizes human intervention and enables automated retrying of failed exploitation attempts until they are successful, thereby boosting the overall \”exploitation yield,\” as per the cybersecurity company.

\”The immediate focus should be on patching and fortifying affected systems,\” it added. \”Hexstrike AI signifies a broader shift in paradigm, where AI orchestration will increasingly be utilized to weaponize vulnerabilities swiftly and on a large scale.\”

This revelation coincides with a study by two researchers from Alias Robotics and Oracle Corporation, who highlighted in a recent publication that AI-powered cybersecurity agents like PentestGPT pose increased prompt injection risks, effectively transforming security tools into cyber weapons through concealed instructions.

\”The tables have turned, the security tool has become an attack vector, and what started as a penetration test concludes with the attacker gaining shell access to the tester’s infrastructure,\” researchers Víctor Mayoral-Vilches and Per Mannermaa Rynning explained.

\”Current LLM-based security agents pose inherent risks when deployed in hostile environments without robust defensive measures.\”