Visitors to an upmarket Kabul hotel attacked by Taliban gunmen have described glaring security breaches before the assailants went on a bloody rampage targeting guests, in a city constantly under threat.

Bags were not checked, scanners did not work and body searches were non-existent, according to witnesses, as the private company providing security to the state-owned Intercontinental Hotel comes under the spotlight.

The 12-hour attack overnight Saturday killed at least 22 people, the majority of them foreigners, including citizens from Venezuela, the Ukraine, Germany and Kazakhstan. A number of Americans were also among the dead and wounded, a State Department official said Tuesday.

The hotel -- its long white facade blackened by smoke -- was still barred to journalists Tuesday, two days after the assault ended.

Authorities are investigating how the six militants were able to slip past Kabul Balkh Safety & Security (KBSS) guards and launch the assault with guns and grenades.

A witness and a security source told AFP that at least two of the gunmen were armed and inside the hotel before the attack began, and questions have been raised -- including by the country's interior minister -- over whether the militants had inside help.

An AFP reporter and driver visited the landmark 1960s building on a hilltop overlooking the Afghan capital on Saturday, hours before the assault began.

They described cursory security checks by KBSS, accounts confirmed by other recent visitors.

"We were told the scanning machines were not working today," said telecom executive Aziz Tayeb, who hid behind a pillar during the assault.

"I also didn't see any armed guard in the scan room just before you enter the building or inside," he said, adding his bags were not searched.

"In the past two weeks, I went to the hotel with my family twice. Out of the three or four checkpoints before the main entrance only one of them checked our car. We were not even body-searched," Ahmad Shafi, a frequent visitor, told AFP.

An AFP driver said that when he arrived at the first checkpoint around 9:30 am Saturday, the hotel guard casually asked him: "Do you have a gun?"

The driver replied "No" and was waved through.

At a second checkpoint, guards looked for magnetic bombs on the car using a mirror and sniffer dog, he said.

A few metres from the hotel lobby the AFP reporter was checked with a handheld metal detector. It is unclear if the baggage scanning machine was working at the time. No armed guards were seen in the immediate vicinity of the hotel.

- Ongoing investigation -

The New York Times quoted a general with the Crisis Response Unit, which responds to frequent Taliban attacks on urban centres, as saying he believed at least three attackers had been inside the hotel for long enough to familiarise themselves with its layout and even bring in equipment.

KBSS declined a request for comment. In a statement the company said it would do "everything in its power" to cooperate with the investigation.

KBSS, which took over hotel security three weeks ago, was formed in 2004 and lists the United Nations and the European Union as among its clients.

A security source told AFP that KBSS has responsibility for protecting the complex only, with its guards not allowed inside the hotel under a contract he said had been signed by Afghan President Ashraf Ghani.

They were also not allowed to search VIPs, he said.

Witnesses have said the guards fled during the attack, though the security source denied that.

The attack followed security warnings in recent days to avoid locations frequented by foreigners in war-torn Kabul.