The Agentic Post
Breaking
Black October 2026: Every Major AI Security Incident, Explained  ·  ARTEX: The Open-Source AI Hacking Tool Behind October’s Biggest Attacks  ·  Chinese Hackers Used AI Agents to Hit 2,250 Microsoft 365 Accounts  ·  PHP2Shell Is Now Being Exploited, and Attacks Began Before the Patch  ·  OpenAI-Backed Thrive Buys ADT for $15.3 Billion to Rebuild It With AI  ·  The AI Data Center Backlash Hits Minnesota and Australia in One Week  ·  
Home/AI Safety
ARTEX: The Open-Source AI Hacking Tool Behind October’s Biggest Attacks

ARTEX: The Open-Source AI Hacking Tool Behind October’s Biggest Attacks

AI Safety

ARTEX, an open-source AI agent hacking tool from China, was linked to Korean bank breaches, a campaign naming targets in 19 countries, and Microsoft's Storm-0940 attack. Its developer pulled it, too late.

AP
Staff
November 1, 2026 · 3 min read

ARTEX, a free, open-source AI hacking tool released in China, has become the common thread in some of October’s most serious attacks. CrowdStrike linked it to break-ins at South Korean banks. Zscaler found an operator using it against organisations in 19 countries. And Microsoft tied it to the Storm-0940 attack on 2,250 Microsoft 365 accounts. Its developer pulled the project from GitHub on October 8, saying it had been misused, but copies were already out.

What is ARTEX?

A penetration testing tool, the kind security teams legitimately use to probe their own systems for weak spots. What makes it different is that it is "agentic": an AI agent runs the job, choosing which systems to scan, which tools to run and what to try next, with a human mostly giving direction. It can plug into different AI models. In plain terms, it turns one attacker into something closer to a small team working around the clock.

What happened to the Korean banks?

CrowdStrike reported on October 7 that an unknown, likely Chinese-speaking and financially motivated actor targeted South Korean financial organisations from late September to early October, and that data was taken. Per industry reporting it cites, one bank’s loan inquiry service for brokers and another’s staff mobile system were breached. Korea’s president ordered an investigation after breaches at seven financial firms.

CrowdStrike found the attacker’s exposed servers and AI session logs. The ARTEX instance ran mainly on DeepSeek V4.1 Flash, with GLM-5.3 and Grok 4.6 used in other sessions inside Claude Code, and DeepSeek likely reached through a reseller. At one point the actor asked an AI where Korean breach data is usually sold. CrowdStrike assessed it as likely, not certain, that ARTEX carried out the bank attacks, and said the number of victims is unknown.

How far did it spread?

Zscaler’s ThreatLabz published records on October 21 of prompts from a Chinese-speaking operator between August 4 and October 4, naming organisations in 19 countries, including the US, UK, Canada, Japan, India, South Africa, Nigeria and the UAE. Targets included dating and social apps, SMS providers, retailers, schools, crypto platforms, payment gateways and gambling sites, with stated goals like collecting personal data and payment API keys. Zscaler did not confirm any specific successful breach. The tooling mixed ARTEX with Claude Code, Codex and Grok workspaces.

Why does this matter?

Because the hard part of hacking used to be skill and time, and AI is removing both. A tool built for defenders, published openly, ended up multiplying attackers. It also shows why AI labs keep tightening who gets cyber capabilities: Anthropic now gates its strongest cyber features behind verification. ARTEX runs on whatever model the attacker connects, including cheap open ones, which is part of why the US banned DeepSeek from federal systems the same month.

How can organisations protect themselves?

  • Patch internet-facing systems fast, ideally within 72 hours of a critical fix.
  • Use multi-factor authentication everywhere, since AI agents excel at rapid password guessing.
  • Limit what any one account or API key can reach.
  • Watch for automated, high-speed scanning and login attempts, a typical signature of AI-driven attacks.

See our Black October roundup, and read CrowdStrike’s report and Zscaler’s research.

Related

Black October 2026: Every Major AI Security Incident, Explained
AI Safety

Black October 2026: Every Major AI Security Incident, Explained
Chinese Hackers Used AI Agents to Hit 2,250 Microsoft 365 Accounts
AI Safety

Chinese Hackers Used AI Agents to Hit 2,250 Microsoft 365 Accounts
PHP2Shell Is Now Being Exploited, and Attacks Began Before the Patch
AI Safety

PHP2Shell Is Now Being Exploited, and Attacks Began Before the Patch
Up Next
Chinese Hackers Used AI Agents to Hit 2,250 Microsoft 365 Accounts

Chinese Hackers Used AI Agents to Hit 2,250 Microsoft 365 Accounts

AI Safety

Microsoft says China-aligned Storm-0940 used the ARTEX AI agent tool to target 2,250+ Microsoft 365 tenants after breaching ConnectWise Cloud Backup. Huntress confirmed hundreds of successful logins.

AP
Staff
November 1, 2026 · 3 min read

Microsoft says a China-aligned hacking group used AI agents to attack more than 2,250 Microsoft 365 business accounts after breaking into a backup service that IT providers use to protect their clients’ data. The group, which Microsoft tracks as Storm-0940, got in through ConnectWise Cloud Backup, formerly known as SkyKick. Microsoft published its findings on October 21, 2026, and said the AI agents scanned, guessed passwords and abused permissions with limited human involvement.

How did the attackers get in?

Through a trusted middleman. ConnectWise Cloud Backup lets IT service providers back up their customers’ Microsoft 365 email and files. To do that, it holds powerful "application identities", think of them as master keys that can open many customers’ accounts at once. Storm-0940 compromised several of these keys. In some cases it added new authentication keys and changed administrator roles so it could keep its access even if a password was reset.

That is what makes supply-chain attacks so dangerous: the victims never did anything wrong. Their IT provider used a reputable backup tool, and the backup tool became the way in.

How big was the attack?

Large and fast. Microsoft says Storm-0940 tried to sign in to more than 2,250 Microsoft 365 tenants, at up to 2,900 attempts a minute, and in some cases gained high-level cloud access within three hours. Most attempts failed. Security firm Huntress, which raised the alarm first, confirmed breaches at 162 tenants by October 16 and later found nearly 1,000 tenants hit by sign-in attempts, more than 300 of which showed successful logins.

What role did AI play?

The group used ARTEX, a free, open-source hacking tool built around AI agents that can run on different AI models. In plain terms, instead of a person typing every command, the AI agent worked through the steps itself: mapping networks, trying passwords and testing what each stolen key could unlock. Microsoft did not say which AI model powered it. ARTEX is the same tool linked to attacks on Korean banks and targets in 19 countries, and its developer pulled it from GitHub on October 8 citing misuse, too late to stop copies already in circulation.

Was customer data stolen?

Not confirmed. ConnectWise says there is "no indication" backup data was compromised. It disabled seven application identities on October 17, took Cloud Backup offline, and began a staged restoration on October 21 that it expects to take several days. ConnectWise has not publicly responded to Microsoft naming Storm-0940. Microsoft says the incident did not come from a flaw in its own systems.

What should businesses do?

  • Keep ConnectWise integrations disabled until ConnectWise confirms they are safe to restore, per Microsoft’s advice.
  • Review Microsoft 365 sign-in logs going back to at least October 15, 2026, looking for logins from apps or places you do not recognise.
  • Audit app permissions: check which third-party apps hold broad access to your tenant, and remove any you no longer use.
  • Ask your IT provider directly whether they used ConnectWise Cloud Backup or SkyKick.

It is the same lesson as AgentCorruption: one over-powerful key in a shared service can open everything behind it. See our Black October roundup for the full month.

Read The Next Web’s report on Microsoft’s findings.

Powered by CookieAdmin