A Chinese Hacking Tool Shows How Fast Agentic AI Attacks Can Outrun Human Defense

On October 21, Microsoft published findings attributing a supply-chain breach at ConnectWise to Storm-0940, a China state-aligned hacking group active since at least 2021. What made the disclosure notable wasn't the attacker — Storm-0940 has a long history of password-spraying attacks using botnet infrastructure — but the tool it used to carry out the breach: ARTEX, a Go-based, open-source multi-agent AI framework built to automate penetration testing from initial reconnaissance through data exfiltration, with minimal human involvement at any stage.

A defense tool, weaponized

ARTEX wasn't built by a nation-state intelligence service. According to reporting that identified its author as Chinese cybersecurity engineer Li Puhua, the framework was released as an open-source project intended for authorized security testing — the kind of tool a legitimate red team might use to simulate an attack against its own employer. Because it's model-agnostic, anyone running it can plug in whatever large language model they have access to; researchers at Zscaler found a customized ARTEX deployment configured to run on DeepSeek, with other instances referencing GLM and Grok. That architecture means no single AI lab's safety fine-tuning or usage policy ever touched the system doing the attacking. On October 8, Li posted a GitHub statement acknowledging the tool was being misused and said the project would go closed-source and stop receiving updates — a gesture that does little to un-release code already forked and running on servers Li doesn't control. China's Foreign Ministry has denied any knowledge of the incidents.

The attack chain itself exploited trust relationships rather than a novel software flaw. Storm-0940 compromised ConnectWise's Cloud Backup application and used the application's own pre-existing, already-granted access into Microsoft 365 tenants to authenticate into customer accounts, bypassing the need for any interactive user sign-in. In some environments the AI agents then moved laterally into Microsoft Graph and directory operations: reconnaissance, changes to application credentials for persistence, and modifications to identities, groups, and privileged roles. Microsoft warned that these credential and role changes can function as a backdoor that survives even after the original compromised application is remediated — meaning cleanup requires auditing far beyond the initial point of entry.

Machine speed versus human speed

The numbers Microsoft disclosed illustrate why agentic tooling changes the defender's math. During a cross-tenant password-spray phase from October 10 to 14 targeting 327 accounts across eight organizations, Microsoft recorded more than 151,000 failed logon attempts, with a single-day peak on October 11 of roughly 2,900 attempts per minute and over 111,000 failures that day alone — tempo no human operations team sustains manually. Separately, ARTEX-driven campaigns reached privileged cloud access at some organizations in under three hours from first contact, across more than 2,250 targeted Microsoft 365 tenants spanning aerospace and defense, energy, financial services, government, and semiconductor sectors. Microsoft said most individual attempts failed, but the group still achieved lasting privileged access at a meaningful number of organizations. The same framework has separately been tied to earlier 2026 attacks on South Korean financial institutions, tracked by Recorded Future under a different designation, suggesting ARTEX circulated among multiple operators well before the ConnectWise campaign surfaced.

Outside analysts framed the real shift as operational rather than technical. IDC's Yih Khai Wong argued the attack timeline runs well beyond what a human analyst queue can process, and that defenders now need automatic containment triggered by preset thresholds, with human review only afterward — "relying on a human to click 'approve' will not cut it," as he put it. He also pointed to a commoditization effect: capabilities once limited to well-funded state units are now available to anyone with an open-source repository and an API key for a capable model. Security Brigade's Yash Kadakia made a related point about detection: a legitimate-looking API call made with stolen credentials looks identical whether a human or an AI agent issued it, pushing defenders toward monitoring what an identity does rather than how it authenticates.

Who answers for the agent

The ConnectWise campaign has become a reference point in a wider argument, visible in Fortune's October 29 coverage dubbing the month's cluster of incidents "Black October," over who bears responsibility when an AI system causes harm that no human directly authorized step by step. Cybersecurity consultant Joseph Steinberg argued that owners of AI systems that carry out hacking should face criminal responsibility and that any testing of such tools should occur on air-gapped servers, not the open internet. Columbia University's Junfeng Yang described a structural asymmetry: AI accelerates attacks much faster than human-paced defensive processes like patch deployment can keep up with, widening the gap between offense and defense with every capability increase.

ARTEX sharpens that debate because it sidesteps the usual chokepoints regulators and AI labs rely on. There is no single company whose terms of service were violated and whose model can be patched or retrained — the framework runs on whichever backend an operator chooses, including open-weight models with no central operator to pressure. Closing the original GitHub repository doesn't retract forks already in circulation. For a policy conversation that has largely focused on persuading frontier labs to harden their own chatbots against misuse, ARTEX is a reminder that some of the most consequential near-term AI risks may not require bypassing any lab's safeguards at all — they only require an agentic framework, a capable model of any provenance, and a target that hasn't yet rebuilt its defenses around the assumption that the thing probing its network never gets tired, never logs off, and never needs to ask a human for the next step.