By Roman Aglaganov
Security researchers have warned for months that AI agents would let small teams of hackers attack many targets at once. This week CrowdStrike published what it describes as an example. It says a group it tracks as Vapor Panda, which it links to China, used an AI agent framework called ARTEX against more than 200 organisations around the world, starting on 17 October.
What CrowdStrike says happened
According to the report, a single ARTEX controller directed attacks on entities in at least 14 countries over 11 days. Targets included foreign ministries in Latin America, Europe, Asia and the Middle East; pharmaceutical, semiconductor, defence and nuclear organisations and think tanks in the US; and telecoms providers in several regions. CrowdStrike says it confirmed that the attackers got in and carried out follow-on activity at nine organisations, and tried to guess or reuse passwords at at least 12 more.
ARTEX coordinates a main agent with planning and worker agents that share a record of facts, findings and goals. The agents tried several attack routes at once, across websites, cloud services, containers and email and VPN systems, and switched approach when one failed. At one drug company, CrowdStrike says, an agent chained two web flaws to obtain cloud credentials that could issue commands to thousands of servers.
The framework ran mainly on DeepSeek’s model, with a second, subscription-based commercial model that CrowdStrike could not identify. In a single intrusion, the planning agents consumed on the order of 1.4 billion input tokens.
A human in the loop
The attacks were not fully autonomous. Recovered transcripts show an operator giving instructions in Chinese, labelled “human instruction”, at decision points: telling the agents to write web shells, extract administrator passwords, or find Windows machines that lacked CrowdStrike’s own security software. What changed, CrowdStrike argues, is scale: one operator steering many simultaneous intrusions, where previous cases it had seen used agents to help with one at a time.
Caveats and advice
The attribution and the figures are CrowdStrike’s, and the company sells the endpoint software its report recommends. It says this campaign is separate from ARTEX activity Microsoft reported earlier in October under a different name, which suggests the framework is spreading. Its practical advice applies to any organisation: rotate keys and passwords after any suspected leak, including those in old backups; enforce signature checks on single sign-on; restrict what cloud roles can do; and patch internet-facing servers.
