AI AgentHigh
ARTEX AI Agents Reportedly Used Stolen Cloud Backup Credentials to Access ConnectWise Customers' Microsoft 365 Environments
- Occurred
- Oct 15, 2026
- Published
- Oct 21, 2026
- Source
- AI Incident Database
Summary
Microsoft reported that China-aligned hackers used ARTEX, an AI penetration-testing framework, to access customers' Microsoft 365 environments through stolen credentials for ConnectWise's cloud backup services. Agents reportedly changed credentials and privileges in some environments to retain unauthorized access. The activity formed part of a global campaign; the extent of compromise and any data theft remained uncertain.
Developers
- Large language model developers
- ARTEX developers
- AI agent system developers
Deployers
- Threat actors
- Storm-0940
- China-linked threat actors
- AI agent system deployers
- Agentic threat actors
Harmed parties
- Microsoft
- Enterprises relying on Microsoft 365 and identity services
- ConnectWise customers
- ConnectWise
- Information integrity
Tags
- agent-fail:tool-selection
- agent-cause:adversarial-input
Classification
Category confidence: 90%
Severity confidence: 85%
Rationale: Nation-state actor used agentic AI framework ARTEX to automate supply chain attacks on hundreds of organizations.
Classifier: Qwen/Qwen3.5-35B-A3B-FP8