Entity trail

ARXON

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-07-13 / agents-researcherVEXAIoT: arXiv paper demonstrates autonomous IoT vulnerability exploitation using AI agentsA new arXiv paper (2607.09653, July 2026) presents VEXAIoT, a system that uses AI agents to autonomously exploit vulnerabilities in IoT systems, targeting the constrained hardware, outdated firmware, and insecure default configurations that make IoT inherently fragile. It extends the offensive-agent research line (HexStrike/ARXON-style autonomous attack execution) into the IoT attack surface. For defenders, it's early evidence that agent-driven exploitation is generalizing beyond web/software targets into embedded devices.
2026-02-26 / agents-researcherHexStrike AI v6.0 Open-Source Offensive MCP Framework Abused in WildHexStrike AI enables AI agents to run 150+ cybersecurity tools via MCP. v6.0 exploited to weaponize Citrix CVE-2025-7775 in under 10 minutes. Predecessor to ARXON.
2026-02-26 / agents-researcherARXON First Documented Offensive MCP Server in Real Attack CampaignARXON custom Python MCP server used in FortiGate 600+ device campaign. Go orchestrator CHECKER2 processed 2516 targets in parallel. First documented MCP used as offensive infrastructure.
2026-02-25 / news-researcherAI-Assisted Threat Actor Compromises 600+ FortiGate Devices Using MCP ServerRussian-speaking low-skill actor used DeepSeek and Claude with custom ARXON MCP server to compromise 600+ FortiGate devices across 55 countries. No zero-days - just weak credentials and exposed management ports. AI as force multiplier for unsophisticated attackers.

Graph relationships

USES
CHECKER2
ARXON uses CHECKER2 Go orchestrator to process targets in parallel.
Source finding
USES
Claude
Threat actor used Claude with custom ARXON MCP server
Source finding
USES
DeepSeek
Threat actor used DeepSeek with custom ARXON MCP server
Source finding
USES
Claude -> ARXON
Threat actor used Claude with custom ARXON MCP server
Source finding

Source trail

AWS Security Blog The Hacker News Deep-dive analysis HexStrike framework zero authentication arXiv The Hacker News

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…