Hackers Adopt Open-Source AI Penetration Tool, Discover the Same Thing Every Intern Does: Automation Makes Mistakes at Scale
Microsoft says a China-state-aligned group used the agentic framework ARTEX against hundreds of organizations. Most attempts failed. The ones that didn't were fast.
Let us begin with a sentence that would have sounded like a thriller pitch five years ago and now reads like a vendor advisory: a threat actor pointed a multi-agent AI system at the internet and told it to go be a hacker.
The details come from Microsoft’s October 21 threat report. The company assesses that Storm-0940, which it describes as a China-state-aligned actor active since 2021, used an agentic AI penetration-testing framework called ARTEX to automate attacks on hundreds of organizations worldwide, starting as early as September 2026. Microsoft also assesses that the group was behind the ConnectWise supply-chain compromise of a multi-tenant application. The Chinese Embassy in Washington, per the Reuters report, responded that China opposes hacking and opposes what it called smears over cybersecurity issues. We note it here and move on to the software, which is the part we are equipped to roast.
What is ARTEX? Per Microsoft, it is an open-source penetration-testing framework that can run with any AI model. It is a multi-agent LLM system written in Go, with a Next.js frontend. Its agents carry out autonomous penetration tests from reconnaissance through data exfiltration, building a graph of discovered assets and vulnerabilities along the way. The interface defaults to English but also supports Korean, Mandarin, Spanish, and Japanese. Microsoft says multiple threat actors in different regions are using it.
Pause on that. A tool built to test security, which is a legitimate and respectable profession, turned out to be equally enthusiastic about the other kind. It has localization. It has a nice frontend. It is, in every sense but one, a well-made product. The one sense is the sense of the word “authorized.”
This is the oldest story in security, and it keeps getting a better UI.
The sequence, as Microsoft tells it: ConnectWise published an initial advisory on October 16 about unauthorized access tied to its Cloud Backup application. After the actor gained control of identities for several ConnectWise cloud apps, it used their existing trust in customer tenants to authenticate without interactive user sign-in. Microsoft says the actor used ARTEX to attempt sign-ins to more than 2,250 tenants. In some environments the activity went further, into Microsoft Graph and directory operations: reconnaissance, adding application credentials for persistence, and changing identities, groups, and privileged roles.
Microsoft is careful to add that this did not result from a compromise of, or vulnerability in, Microsoft’s own systems or products. Several attacks, however, gave the actor privileged access to cloud infrastructure, in some cases less than three hours after initial targeting.
Three hours. That is shorter than most companies’ approval process for a new font.
Here is where the numbers get funny, in the dry way that numbers get funny when you are not one of the organizations involved. A password-spraying campaign between October 10 and 14, from a single IP address, targeted 327 accounts across eight organizations. Microsoft telemetry recorded more than 151,000 failed logons, peaking around 2,900 failures per minute on October 11. Forty-eight accounts received over 1,000 failures. Lockouts accounted for nearly 98 percent of the activity. The spraying produced no successful authentications.
Read that again. The machine tried 151,000 times and got zero. The agent worked tirelessly, around the clock, at machine speed, and the entire result was a very large amount of the word no. If that were a salesperson, we would call it a dedication to the craft.
Per Microsoft, most of the targeting failed. Per Reuters, the actor nonetheless quickly gained privileged cloud persistence, meaning access that could survive cleanup, at many organizations. That is the whole lesson in one sentence: when you run attacks at machine speed, the failure rate stops mattering. You only need the rate of success to be above zero, and defenders need it at zero forever.
Microsoft’s analysis of what the AI changes is measured and worth quoting in spirit. Agents can run around the clock and pursue several breach paths at once, shortening the time from target selection to objective. ARTEX accelerated scanning, reconnaissance, password spraying, and OAuth application abuse to machine speed. And automated activity generates large volumes of logs and alerts, leaving defenders little time to respond in a coordinated way. The Neuron’s digest frames the case as a sign that such tools can compress offensive cyber operations.
Notice what it does not say. It does not describe an unstoppable superhuman hacker. It describes ordinary, well-understood techniques, password spraying and OAuth abuse, executed by something that never needs coffee, sleep, or a weekend. The sophistication is in the tirelessness, not in the trick. Which is, if you think about it, exactly how every other job gets automated.
The practical guidance is unglamorous, as practical guidance tends to be. Microsoft recommends keeping affected ConnectWise connections disabled until ConnectWise issues restoration guidance, preserving evidence before deleting anything, and searching for the affected apps by application ID. Review Entra sign-in and audit logs, Microsoft 365 audit logs, and Graph activity from at least October 15, ideally from October 1. Revoke unnecessary permissions, rotate credentials after confirmed suspicious activity, apply least privilege to multi-tenant app permissions, and monitor for credential additions and privilege assignments.
ConnectWise CEO Manny Rivelo said, per Reuters, that based on Microsoft’s analysis, “it appears that a China state-aligned group was responsible for the attack on ConnectWise Cloud Backup.” The company has cut off the affected connections and is restoring services in phases. It added that those steps do not remove unauthorized access that may already exist within individual customer tenants, which needs separate review. In other words: the front door is fixed, but someone should still check the closets.
The bright side, such as it is, is that the defenders have the same tools. The same week brought emergency PHP patches and a general reminder that AI is now on both sides of the keyboard. The difference is in who has to be right: the attacker, once; the defender, constantly, with a log volume that has just been multiplied by a robot.
Somewhere there is an ARTEX instance retrying a login. It will retry again. It will not be discouraged. If only we could say the same about the rest of us, on a Monday.
Sources: