On October 21, Zscaler ThreatLabz published research on a global hacking campaign run largely by AI. On October 22, Microsoft linked the same AI framework to a supply chain attack on ConnectWise customers. Two different investigations, one tool, one day apart. Standard disclosure: I work at Zscaler, so yes, I'm proud of the ThreatLabz team on this one. But the story matters more than the logo.
What ThreatLabz Found
ThreatLabz tracked prompts from an operator between August 4 and October 4, 2026, and what they describe is less "hacker with a chatbot" and more "hacker running a small AI company."
- The framework: The operator customized ARTEX, an AI-assisted penetration testing framework, and connected it to Claude Code, Codex, and Grok workspaces.
- The org chart: Models had jobs. DeepSeek did initial investigation, and GLM reviewed its findings for gaps. Yes, the attacker built a peer review process. Most security teams don't have one.
- The memory: Custom scripts synced instructions and memory files across accounts and servers, and project folders tracked targets, progress, and findings so AI sessions could pick up where they left off.
- The jailbreak: Prompts told the AI to treat every target as preauthorized and to cut down on approval steps.
Targets spanned 19 countries, including South Korea, the US, the UK, India, and Nigeria, across dating apps, SMS providers, retail, education, investment services, crypto platforms, and legal claims administration. The operator was after personal data, phone numbers, transaction records, payment API keys, and admin access. ThreatLabz assesses it as financially motivated, partly because the operator literally asked the AI where stolen Korean data usually gets sold. Attribution points to a Chinese-speaking operator based on prompt language, time zone settings, and a mainland China mobile number used across accounts.
One honest caveat from the research: the model IDs the operator requested weren't independently verified, so ThreatLabz notes some sessions may have run on different models than the prompts asked for.
Then Microsoft Connected the Dots
A day later, Microsoft tied ARTEX to Storm-0940, a China-aligned group behind a large supply chain compromise targeting ConnectWise Cloud Backup users. Using compromised ConnectWise application credentials, the attackers automated attacks against Microsoft 365 tenants at roughly 2,900 sign-in attempts per minute, hitting hundreds of organizations without ever needing a user to authenticate interactively.
Then they changed OAuth application credentials to stay in. That's the part that should keep people up at night: those backdoors can survive after the original hole is patched. ConnectWise suspended the affected services on October 17, and the full scope of data theft is still under investigation.
What This Actually Means
For years the defender's quiet advantage was that attackers are human. They sleep, they get bored, they make typos at 3am. ARTEX removes all of that. It works around the clock, keeps notes, reviews its own work, and resumes exactly where it stopped.
You can't out-staff that. You have to out-architect it:
- Shrink what's reachable. An AI agent can't brute-force a login page it can't see. If it's reachable, it's breachable, and automation just made "reachable" a lot more expensive.
- Least privilege everywhere, including apps. The ConnectWise attack rode application credentials, not user passwords. Service accounts and OAuth apps need the same scrutiny as people.
- Assume persistence. After an incident, audit OAuth grants and app credentials, not just user accounts.
- Put decoys in the path. An AI that explores everything will also explore your deception assets, and that's a fast, high-confidence alert.
The Other Side of the Coin
Same day as the ThreatLabz research, NVIDIA launched its OpenShell Reference Architecture for building and containing safe AI agents, and Zscaler is one of the cybersecurity vendors supporting it. It's the right counterweight to ARTEX: if attackers are going to run agents, defenders need agents with hard boundaries on what they can reach and do. Same technology, very different guardrails.
Update, October 31: Make it three research teams. CrowdStrike reported on October 29 that VAPOR PANDA, a China-nexus state-sponsored group, used ARTEX to run parallel intrusions against more than 200 organizations starting October 17, with confirmed post-exploitation at nine. Separately, BleepingComputer reports Chainalysis told customers its October incident involved "offensive agentic techniques." Write-up here. (CrowdStrike)
Bottom Line
ARTEX is the clearest proof yet that AI-run attacks aren't a conference keynote prediction anymore. They're in the wild, they're organized, and two separate research teams caught the same tool in the same week. The fix isn't a smarter alert. It's an architecture where an untiring attacker finds nothing to attack.
Full research: Inside a Global AI-Assisted Hacking Campaign (Zscaler ThreatLabz)
Also: Microsoft links agentic AI to ConnectWise supply chain breach (SC Media) and NVIDIA Launches OpenShell Reference Architecture for Safe AI Agents