Rohan Paul (@rohanpaul_ai) · 10/22/2026, 11:41:27
Microsoft Report: Open-Source AI Agent Artex Automates Cyberattacks
Microsoft reports that the Chinese state-aligned actor Storm-0940 used an open-source AI agent named Artex to automate cyberattacks on hundreds of global organizations. Artex chains LLM agents to execute penetration testing from reconnaissance to data theft, achieving privileged cloud access in under 3 hours and drastically reducing defenders' response time.
SOURCE COVERAGEFull Original Report
Rohan Paul (@rohanpaul_ai) · 2026-10-22 03
Microsoft published a new report saying that it has seen cyberattacks carried out by a Chinese state-aligned actor called Storm-0940, which used a Chinese AI agent named Artex to automate attacks aimed at hundreds of organizations worldwide in a broad range of industries.
ARTEX, released on GitHub as open source, chains LLM agents through a penetration test from reconnaissance to data theft with little human input.
The keys belonged to ConnectWise’s Microsoft 365 backup and management apps, already trusted with wide access, so signing in skipped user logins and MFA.
Several ARTEX-driven intrusions went from first targeting to privileged cloud access in under 3 hours.
Inside some tenants, the agents queried Microsoft Graph, added credentials to other apps and had a ConnectWise app grant itself Global Administrator.
Most targeting still failed, including a password spray that logged 151K+ failures without one success, and an app sign-in alone does not prove theft.
OAuth app abuse is old Storm-0940 tradecraft, but ARTEX ran it fast enough to leave defenders little time between alert and revocation.
