Detection Lessons From Five Agentic Attack Frameworks

Agentic attack framework detection telemetry has to connect rapid actions with the identity that made them. In a 13 November 2026 analysis, Elastic Security Labs examined ARTEX, CyberStrikeAI, Cairn, PentAGI and HexStrike. Its source review found that none enforces authorization in code by default. The useful defender question is which events these tools create in hosts, web logs, cloud audit trails and sign-ins.

Elastic describes an LLM planning loop that chooses ordinary offensive tools, interprets results and starts another action. The model and much of the tooling can run outside the target network. Defenders therefore see the effects of tool use, rather than the model’s reasoning. This article turns Elastic’s comparison into a detection workflow and keeps its incident references attributed to their original reporters.

What the Five Frameworks Change

The common pattern is a planning loop with little waiting between steps. GTIG and Mandiant observed ARTEX execution sequences in bursts of roughly two to 25 seconds. NorForge reports that Cairn projects reaching their goals in its AIA0001 actor cluster took a little under 23 hours on average from start to goal. Those are different observations, not a shared timing benchmark for all five tools.

Elastic says ARTEX uses parallel workers, while CyberStrikeAI combines an operator console with additional access tooling. Cairn delegates tasks to coding agents in containers. PentAGI uses a reflector agent to keep a hesitant worker acting. HexStrike exposes tools through MCP to an external AI assistant, so it has no model of its own.

Framework	Framework design	First telemetry to join
ARTEX	Planner and parallel workers	Web activity, account creation and later sign-ins
CyberStrikeAI	Console and access tooling	Web activity, host processes and cloud identities
Cairn	Coding agents in containers	Container process ancestry and outbound activity
PentAGI	Reflector-assisted agent loop	Repeated browsing and host connections
HexStrike	MCP tool interface	Tool-serving process and its child processes

These are investigation starting points drawn from Elastic’s comparison. A row does not prove that every deployment produces the same events. Tool defaults can change, and legitimate security testing can create similar traffic. Validate each finding against authorization records and the identity behind the action.

Why agentic attack framework detection telemetry starts with identity

Elastic reports that four frameworks run without a human approval prompt by default in the configurations it inspected. It also found prompt text asserting authorization in three frameworks. A prompt assertion is not an enforced target boundary. Elastic describes only narrow default target blocklists, while other scope settings require operator configuration or go unused.

This matters because the agent inherits the reach of its credentials. A scan may become an authenticated web session, then a cloud API call, with each event appearing ordinary in isolation. A cyber threat intelligence platform belongs in this workflow when teams correlate external framework context with their own identity and event records. The product does not replace the underlying host, identity and cloud logs.

Our detection reading is to group sensitive actions by the issuing identity and role before grouping by source address. Review how many distinct actions occur in a short interval. Then extend the lookback to connect discovery, secret access and remote execution across sessions. Elastic recommends both short-window tempo analysis and longer sequence correlation.

A source address remains a useful pivot, but it is a fragile containment boundary. Elastic says ARTEX and CyberStrikeAI can change routes after a block. The same operation may reappear from another address or client signature. Match the requested action and the credential used, then confirm whether revocation actually stops the next request.

How to hunt without treating every burst as an attack

Elastic’s sample hunt groups web, proxy or cloud requests by source address in one-minute windows. It normalizes clients into tool families and selects windows with at least three families and 20 requests. These are tuning values in Elastic’s example, not a universal threshold. Build systems, shared proxies and administrators can produce similar mixes.

Start with coverage: retain process creation, web requests, cloud audit events and sign-ins with a common identity or session key. Baseline approved automation that changes clients quickly. Promote a burst when it connects to unusual secret reads, new accounts or remote execution. The AI agent logging guide provides related logging concepts for systems your organization operates.

Framework fingerprints can help an initial hunt, but Elastic warns that default strings and tool builds change. The five tools can also use ordinary scanners and cloud clients. Our rule is to preserve fingerprints as enrichment while making the alert depend on action sequence, identity context and expected workload. An address or User-Agent match alone warrants investigation, not automatic attribution.

• Confirm telemetryCheck host, web, identity and cloud log coverage for the same time period.
• Join the identityGroup sensitive actions by user, role and session before source address.
• Compare the tempoBaseline normal automation before escalating short bursts.
• Reconstruct the sequenceConnect discovery, secret access and execution across sessions.
• Contain the credentialRevoke sessions and rotate exposed secrets alongside network blocks.
• Verify the resultConfirm subsequent requests fail and review for renewed access.

The checklist is our operational ordering of Elastic’s detection and response guidance. Decide which high-confidence combinations can trigger automated containment before an incident. Require a human review for ambiguous matches, especially shared network addresses or authorized red-team work. Preserve the linked evidence so responders can explain why an action was taken.

What a blocked request does not settle

Elastic warns that blocking one network address can leave an agent’s credential usable. Its comparison describes ARTEX and CyberStrikeAI changing their route when blocked. Responders should therefore revoke affected sessions and tokens, rotate exposed credentials and test the next attempted request. They should also limit assumed roles and application identities to necessary actions.

Revocation is not always immediate. Elastic points to cloud-provider propagation delays and existing access tokens as reasons to verify the result. Treat an accepted revoke operation as a step, not proof that access ended. The ARTEX and exposed secrets analysis provides a separate example of why an agent’s reachable secrets matter.

The framework comparison is not proof that every suspicious sequence was autonomously chosen by a model. Elastic’s article combines source-code inspection with incident reports from other organizations. We have not independently verified those referenced cases here, and this draft does not transfer their attribution to Brandefense. Detection should still focus on observable behavior, whatever made the decision.

Method and scope

This analysis uses Elastic Security Labs’ 13 November 2026 framework comparison, GTIG’s direct ARTEX observations and NorForge’s direct Cairn analysis for the timing examples. Its five-framework comparison supports the design and default-control claims above. The timing examples retain each original researcher’s scope; our detection ordering is our own. We omit repository links, exact indicators, exploit steps and third-party incident details.