Microsoft says an agent framework ran a state hacking campaign, and the weak spot was access customers had already granted
Microsoft Threat Intelligence said on October 21 that a China-aligned group it tracks as Storm-0940 used ARTEX in a campaign that went through a compromise of IT vendor ConnectWise and reached hundreds of organizations worldwide. Microsoft describes ARTEX as a system of LLM-driven agents that runs an autonomous penetration test from start to finish with little human involvement. In several cases, the time from first targeting to privileged access was under three hours. Microsoft says no Microsoft vulnerability was involved. Link: https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/
TechCrunch's follow-up the next day put the reach at around 2,250 organizations. The entry point was not a stolen password. It was the standing permissions customers had already granted to ConnectWise's applications, which let activity look like a trusted vendor doing its job. Microsoft's point is that none of the techniques are new. What is new is the speed and the small number of humans needed to run it. TechCrunch: https://techcrunch.com/2026/10/22/chinese-hackers-spied-on-thousands-of-companies-after-breaching-it-giant-connectwise/
The same day, developer platform Railway told all users to rotate their secret keys after attackers may have accessed encrypted environment variables, and for some users the decrypted values. TechCrunch reports Railway framed it as part of a campaign aimed at AI inference providers, and it follows the LiteLLM package compromise and the OpenCode breach from earlier this week. A post-mortem is promised. TechCrunch: https://techcrunch.com/2026/10/22/developer-platform-railway-urges-all-users-to-revoke-secret-keys-after-cyberattack/
Put it together and the pattern is uncomfortable. The things agents need in order to be useful, long-lived app grants, API keys in environment variables, gateways that hold keys for many providers, are the same things attackers are now going after, and the attackers have agents too. OpenAI's response came a few hours earlier: from November 20, model routers and AI gateways need OpenAI's review and approval before offering access to its models. Link: https://openai.com/index/broad-access-through-consistent-standards/ The practical takeaway for teams running agents is dull and urgent: shorter-lived credentials, narrower grants, and an inventory of which vendors hold standing access to your tenant.
← Back to all articles
TechCrunch's follow-up the next day put the reach at around 2,250 organizations. The entry point was not a stolen password. It was the standing permissions customers had already granted to ConnectWise's applications, which let activity look like a trusted vendor doing its job. Microsoft's point is that none of the techniques are new. What is new is the speed and the small number of humans needed to run it. TechCrunch: https://techcrunch.com/2026/10/22/chinese-hackers-spied-on-thousands-of-companies-after-breaching-it-giant-connectwise/
The same day, developer platform Railway told all users to rotate their secret keys after attackers may have accessed encrypted environment variables, and for some users the decrypted values. TechCrunch reports Railway framed it as part of a campaign aimed at AI inference providers, and it follows the LiteLLM package compromise and the OpenCode breach from earlier this week. A post-mortem is promised. TechCrunch: https://techcrunch.com/2026/10/22/developer-platform-railway-urges-all-users-to-revoke-secret-keys-after-cyberattack/
Put it together and the pattern is uncomfortable. The things agents need in order to be useful, long-lived app grants, API keys in environment variables, gateways that hold keys for many providers, are the same things attackers are now going after, and the attackers have agents too. OpenAI's response came a few hours earlier: from November 20, model routers and AI gateways need OpenAI's review and approval before offering access to its models. Link: https://openai.com/index/broad-access-through-consistent-standards/ The practical takeaway for teams running agents is dull and urgent: shorter-lived credentials, narrower grants, and an inventory of which vendors hold standing access to your tenant.
Comments