> status: mostly fine. patch anyway.practical AI security · est. 2026

Calm down. · Both

No, an AI didn't break into 140 targets in 11 days

By alkizz ·

"China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days," says the CyberScoop headline. If you've already pictured a swarm of AI agents tearing through every network on Earth while the humans go get coffee, calm down. The attacks were real, but the 140 isn't in CrowdStrike's own report, and the tricks the agents used are ones you can fix this week.

What CrowdStrike actually says

The primary source is CrowdStrike's Oct 29 blog post on Vapor Panda, a China-linked group that CrowdStrike says has been active since 2021. Starting Oct 17, the group pointed an open-source AI pentesting tool called ARTEX at more than 200 organizations in at least 14 countries over an 11-day window, and CrowdStrike calls it the group's "first observed use of AI-driven intrusion tooling."

So far, so scary. But the number CrowdStrike puts in writing is smaller than the headline. It "confirmed post-exploitation activity at nine organizations," and it saw password spraying and credential scanning against at least 12 more. Nine is bad news for those nine, but it isn't 140.

The 140 comes from an interview. CrowdStrike told CyberScoop that about 70% of the targets "were confirmed compromised or had evidence indicating moderate confidence of a successful intrusion," and 70% of 200 is about 140. That figure mixes confirmed cases with moderate-confidence ones, and it isn't in the blog post.

The scariest-sounding line is about the U.S., and it says "targeted." CrowdStrike writes that "a separate engagement targeted 19 U.S.-based organizations in the pharmaceutical, semiconductor, defense, nuclear, and financial sectors." Targeted means the attackers went after them, and it doesn't say they got in.

Claimed vs. confirmed

What the doom version says What the sources say
An AI compromised 140 sensitive targets CrowdStrike's post confirms post-exploitation at 9 organizations. "About 140" comes from an interview quote that counts moderate-confidence cases too
19 U.S. pharma, defense and nuclear orgs were breached The post says a separate engagement "targeted" them
AI invented a new kind of attack Every entry point CrowdStrike lists is an old, known mistake. CrowdStrike's Adam Meyers told CyberScoop it's "just doing it at a speed and scale that we're unaccustomed to"
There's a scary new CVE to patch CrowdStrike names no CVE, and neither does CyberScoop

The old tricks, done fast

This is the part that should lower your blood pressure. Going by CrowdStrike's write-up, the agents didn't find anything magic, and they got in through stuff that's been on every security checklist for years:

None of that is new, and the only new part is the speed. Microsoft saw the same tool used by a different group, Storm-0940, where it found cases of under 3 hours from first targeting to privileged access. That's the real lesson here, because a stale key you were going to rotate "sometime this quarter" now gets found in an afternoon.

And it's still a real campaign, which CyberScoop reports "remains active," and that's why this is a 2 and not a 1. If you defend a foreign ministry, a telco or a pharma company, it's a lot higher than 2 for you. For most people reading this, it's a reminder to do the boring stuff.

There's also a funny bit. CrowdStrike says the attackers' own ARTEX controller "intermittently exposed adversary tooling, target files, and ARTEX agent transcripts." Even the attackers left their agent's files where other people could see them, and that brings me to the other half of this.

If you run ARTEX, or anything like it

ARTEX was open source (AGPL), and its author has since taken it closed source, but the published versions are still on the Go module proxy and forks are still around. I've covered ARTEX and Storm-0940 before in the Wiz agentic attacks brief, so I'll keep this to the setup problem.

This part is from reading the public code (not tested). The stock Docker setup publishes the web UI and API on port 8787 on all network interfaces, and only the 8788 proxy is bound to localhost. The README does say to expose only 443 and keep 8787 internal, but the default file doesn't do that for you. And the first-run setup sets the admin password through an API call that's only rejected once a password exists, so on a fresh instance anyone can reach, whoever shows up first sets the admin password. If that's not you, someone else now has a pentest agent with your AI key in it.

The same goes for any self-hosted agent that ships with a dashboard. If the first visitor gets to set the password, make sure the first visitor is you.

I think this one ties back to my piece on AI attacks, where I talked about how AI attacks are very loud and leave very obvious fingerprints, like all the testing notes.

What to do:

Update: Unit 42

Palo Alto Networks' Unit 42 posted its own notes on ARTEX activity on Oct 30, and they back up my point about AI attacks being loud. Some context first. Unit 42 says ARTEX was forked more than 12,000 times before it went closed source on Oct 8, and that ARTEX use alone doesn't identify a specific actor, so this isn't necessarily Vapor Panda. The activity Unit 42 saw ran from Sep 24 to Oct 27, and it says it's ongoing.

After mapping the apps, the attackers went after identity providers, with password spraying, login probes and password-reset tricks, but Unit 42 says no successful IdP account compromise was observed. So they fell back to the apps' exposed APIs, and the wins came from app mistakes, not clever AI. On one production web app, they could register their own accounts, then read about 50 MB of API data and push through bulk approvals and user record changes. On a development API, the document store accepted writes with no login at all.

The recon wasn't magic either. The agent mapped each app by downloading public JavaScript source maps and bundles, runtime config files and OpenAPI specs, and then it called the routes those files described.

And it was loud. Unit 42 saw bursts of about one request per second, separated by regular 25 to 31 second pauses, which it says fits waiting on the AI model between steps. When the API sent back 422 validation errors, the agent re-read the spec and fixed its requests until the writes went through. After every successful write, it immediately read the record back to check that it worked. Those are exactly the kind of fingerprints I meant, and Unit 42 says the pattern goes beyond conventional scanners and fits an AI planner reasoning over its results.

Sources

Related

On the checklist

More briefs

← All briefs