ARTEX is an open-source, multi-agent penetration testing framework, and since late September 2026 security firms have tied it to real intrusions at banks, government agencies, software vendors and a Dutch security nonprofit. Every report describes ARTEX being pointed at its targets, and none says it picked victims on its own. The agents did the repetitive work at machine speed.
This explainer covers what ARTEX is, what each report says, where the sources disagree, and what site owners and small IT teams can check. We have mostly written about agents as something to defend, as in our post on agent runtime security. This is the other side: agents run by attackers. Facts are as of November 4, 2026.
The short version: ARTEX automates the slow parts of an attack. It maps an app, tries logins, tests known flaws and chains together whatever works. Wiz, one of the firms tracking it, says none of the individual techniques were new. The defenses are ones you already know: patch exposed apps fast, enforce MFA and lockouts against password spraying, keep logs you can search, and rotate keys after any exposure.
What ARTEX is and how it works
Microsoft’s October 21 threat report describes ARTEX as an open-source penetration testing framework that can use any AI model. It is a multi-agent system written in Go with a web front end. Its agents run tests from reconnaissance through data theft and record what they find in a graph.
CrowdStrike gives a similar picture: a main agent directs planner and worker agents over a shared graph of facts, findings and goals. Wiz adds the tool names. A planner picks the next step, and worker agents run standard tools such as nmap, curl and Impacket.
If AI agents are new to you, the idea is simple. One model breaks a goal into tasks, others carry them out, and the results feed the next round. ARTEX applies that loop to break-ins.
On its origin, Wiz’s October 22 write-up says a Chinese developer published it on GitHub in July 2026. The developer made it closed-source on October 8, Wiz says, after it had more than 12,000 forks. Those copies remain in circulation.
Where ARTEX has turned up so far
Each row below comes from the organization that investigated the case.
| Reported | Source | Who was targeted | What they said |
|---|---|---|---|
| Oct 7 | CrowdStrike | South Korean financial firms | Data stolen; number of victims unconfirmed |
| Oct 21 | Microsoft | Hundreds of organizations, including ConnectWise customers | Sign-in attempts on more than 2,250 tenants |
| Oct 22 | Wiz | IT and software vendors, identity providers | Password spraying aimed at hundreds of users |
| Oct 29 | CrowdStrike | Government, telecom, defense and others | 200+ organizations, nine confirmed breaches |
| Oct 31 | DIVD | Its own helpdesk server | Initial access to root in twelve minutes |
| Nov 2 | WorkOS | An internal sales tool | Contact records and call summaries accessed |
The largest is VAPOR PANDA. CrowdStrike’s October 29 report says this China-nexus group used ARTEX against more than 200 organizations in at least 14 countries over 11 days, starting October 17. CrowdStrike confirmed follow-on activity at nine of them, where the group installed a backdoor called BLOODALCHEMY. It ran ARTEX mainly on DeepSeek models.
Microsoft attributes its case to Storm-0940, a China-state-aligned actor. Microsoft says that in several cases, less than three hours passed between first targeting and privileged cloud access. It also says most of the targeting failed.
The Dutch Institute for Vulnerability Disclosure (DIVD) was hit through two unknown flaws in Zammad, its helpdesk software. Its incident page named ARTEX on October 31 and counted more than 450,000 requests.
Who directs ARTEX in these campaigns
Some headlines read as if AI broke into a bank by itself. The reports do not say that.
CrowdStrike recovered transcripts from the VAPOR PANDA campaign. An operator gave instructions in Chinese, labeled as human instructions and timestamped in China Standard Time. The operator told the agents to write web shells, pull domain administrator passwords and list which machines had endpoint sensors. CrowdStrike says the operator stepped in to steer at decision points.
In the Korean bank case, CrowdStrike’s October 7 report found a Chinese-language pentesting prompt written by the operator. It describes ARTEX as "a recently released open-source agentic penetration testing (pentesting) tool developed in China."
DIVD describes the setup this way: "You give it a target and a model of choice, and the agent decides every step itself." Wiz says the same: an operator supplies a target and an objective.
So the agents choose individual steps, and people choose victims and goals. What changes is speed and scale. A small team can now test hundreds of organizations at once. That costs money: CrowdStrike says the planning agents in one VAPOR PANDA intrusion used about 1.4 billion input tokens.
Where the ARTEX reports disagree
Treat every number here as belonging to the firm that published it. The sources differ on several points.
- Who built it. CrowdStrike says it was developed in China. Wiz says a Chinese developer published it. Microsoft and DIVD do not name a developer.
- Who is using it. Microsoft says it has seen multiple threat actors across several regions use ARTEX. CrowdStrike, Microsoft and Wiz describe at least three operators: VAPOR PANDA, Storm-0940 and the unnamed actor in Korea.
- How many victims. CrowdStrike counts 200+ targeted and nine confirmed. Microsoft says hundreds targeted. Wiz gives no total. CrowdStrike’s Korea report says the count is unconfirmed.
- How hands-off it was. DIVD’s account stresses that the agent decided each step. CrowdStrike’s transcripts show a person steering.
WorkOS is a special case. Its security bulletin says only that investigators found "an AI-assisted offensive security framework." The ARTEX name comes from founder Michael Grinich’s post on X the same day.
What ARTEX activity looks like in your logs
Wiz published the most detail on what ARTEX traffic looks like from the receiving end. Its password spraying used a new user agent for each burst. Attempts came about one second apart, in bursts of 20 to 60 minutes, across sessions of 24 to 30 hours. It focused on software engineer accounts.
Before attacking logins, the agents mapped each app. Wiz saw them download JavaScript bundles, source maps, runtime config files and API docs. They hammered password reset, username recovery and account activation endpoints. Where sign-up was open, they registered accounts with throwaway email addresses and probed for access to other tenants’ data.
Published user agents include norma/0.4 and ReconProbe/1.0 (Wiz) and azure-toolkit/1.0 (Microsoft). Both firms also list common strings such as curl/7.88.1 and Python-urllib/3.12. BleepingComputer reports that Grinich cited artex-enrich/1.0 and norma/0.4 in the WorkOS case. We could not find that detail in WorkOS’s own bulletin.
On Windows and cloud systems, CrowdStrike suggests hunting for command lines containing "artx" or "artex," cloud roles with an artx prefix, and a C:\ProgramData\artx5v\ folder.
What site owners and small IT teams can check about ARTEX
None of this needs new tools. It needs the basics done consistently.
-
Patch internet-facing apps quickly. DIVD was breached through its helpdesk. CrowdStrike tells defenders to patch exposed appliances, especially long-lived Linux servers. Our guide to reading a CVE helps decide what goes first.
-
Blunt password spraying. Require MFA on every account that faces the internet, and prefer passkeys where you can. Microsoft’s report shows lockouts working: one campaign logged more than 151,000 failed sign-ins against 327 accounts, with no successful sign-in observed.
-
Alert on spray patterns. Many failed logins across many users from one IP, followed by one success, is the pattern to flag. Wiz says existing detection rules for this pattern flag ARTEX traffic.
-
Rate-limit recovery and sign-up endpoints. Password reset, username lookup and account activation need limits and logging too.
Logs, old keys and third-party apps
The rest of the list covers seeing the activity and removing access an attacker may already hold.
-
Keep build files off production. Source maps, environment files and API docs gave ARTEX its map. Remove what visitors do not need. This is our advice, based on Wiz’s list.
-
Keep logs you can search. Web access logs and identity provider sign-in logs are where this activity shows. Microsoft told ConnectWise customers to review sign-in history back to October 1 where records exist.
-
Rotate old keys. In one VAPOR PANDA case, the operator used keys from a 2022 directory export that were likely never rotated. CrowdStrike says to rotate keys found in backups and exports, too.
-
Review third-party app access. Storm-0940 abused ConnectWise apps already trusted inside Microsoft 365 tenants. Check which outside apps hold permissions in your tenant, and trim them.
If you are a WorkOS customer, WorkOS warns that copied contact details and call notes may fuel phishing. Verify unexpected requests, even ones that mention a real colleague. If you find signs of a breach, start your data breach response plan.
Frequently Asked Questions
What is ARTEX in simple terms?
ARTEX is an open-source framework that uses AI agents to run penetration tests. A planner agent picks steps, worker agents run standard hacking tools, and the results feed the next step. Security firms have found attackers using it against real organizations.
Does ARTEX hack on its own?
No published report says so. Each describes ARTEX being given a target. CrowdStrike’s recovered transcripts show an operator giving instructions and steering the agents at decision points.
Who made ARTEX?
CrowdStrike says it was developed in China, and Wiz says a Chinese developer published it on GitHub in July 2026. No report we read names the developer. Wiz says it went closed-source on October 8 after more than 12,000 forks.
Which AI models does ARTEX use?
Microsoft says it can use any AI model. CrowdStrike says VAPOR PANDA ran it mainly on DeepSeek, and the Korean bank attacker used DeepSeek v4.1-flash as its backend.
How many organizations has ARTEX been used against?
It depends on the source. CrowdStrike counts more than 200 targeted by VAPOR PANDA, with nine confirmed breaches. Microsoft says Storm-0940 targeted hundreds. Other reports give no total. As of November 4, 2026, no one has published a combined count.
Can I block ARTEX by user agent?
Not reliably. Some published strings, such as curl/7.88.1, are common tools, and Wiz saw the actor rotate user agents. Use them to search logs, not as your only block rule.
Is ARTEX the only AI attack framework in use?
No. On October 21, CrowdStrike reported four other actors running their own agent setups, several built on Claude Code or open-source projects such as PentestGPT.
What is the most useful thing a small team can do this week?
Check that every internet-facing login has MFA and lockouts, patch exposed apps, and confirm you can search your sign-in and web logs. Those three cover most of what the ARTEX reports describe.
Was the DIVD breach caused by ARTEX alone?
DIVD says the attacker used ARTEX and two Zammad zero-days, going from initial access to root in twelve minutes. DIVD does not say who launched it. It urged everyone running Zammad to update to version 7 or take it offline.
