AI for Hacking: CrowdStrike Says ARTEX Targeted 200+ Orgs

Using AI for hacking now has a detailed, real-world case file. In a report published October 29, 2026, CrowdStrike said a group it tracks as VAPOR PANDA used ARTEX, an AI agent framework running mainly on the DeepSeek model, to target more than 200 organizations in at least 14 countries over 11 days starting October 17. The report describes an AI cyber attack in unusual detail, including how the AI hacking tools were organized and where a human stepped in.

That headline number needs a careful reading. CrowdStrike's 200-plus figure counts organizations targeted. CrowdStrike confirmed post-exploitation activity at nine of them, and it saw password-spraying (guessing passwords across many accounts) and credential-scanning against at least 12 more.

In CrowdStrike's account, then, the software went after hundreds of organizations, a much smaller set saw confirmed follow-on activity, and a human operator steered the agents at the key decision points. NBC News reported the findings the same evening; it attributed the figures to CrowdStrike and did not say it had verified them independently.

What is ARTEX AI?

ARTEX AI is an agentic penetration-testing tool, a kind of hacking AI: software that uses large language models to plan and carry out the stages of a network intrusion that a human security tester would normally work through by hand. Penetration testing itself is a legitimate trade. Companies hire testers to break into their own systems with permission so they can fix the holes before someone hostile finds them.

An AI hacker tool built for that job can also be run against targets that never agreed to be tested, which is the situation CrowdStrike describes. ARTEX was first unveiled in July, according to Korea JoongAng Daily, and CrowdStrike's earlier report describes it as a recently released open-source tool developed in China.

In the VAPOR PANDA campaign, CrowdStrike says the primary model behind ARTEX was DeepSeek, a Chinese-origin large language model. A second, subscription-based commercial LLM was also used, and CrowdStrike Intelligence could not confirm which one.

The earlier South Korea case is a separate story

ARTEX first made headlines in a different investigation. On October 7, CrowdStrike reported that an unknown threat actor used ARTEX against South Korean financial organizations from late September to early October 2026. In that case CrowdStrike assessed, with moderate confidence, that the actor was financially motivated, and it noted that the bank breach details came from industry reporting rather than its own verification. In its words, "the number of organizations affected remains unconfirmed."

After those attacks, the developer, who posts on GitHub as "Autumn-27", said ARTEX would become closed-source with no further public releases, citing "misuse of the tool", and Korea JoongAng Daily relayed Reuters' report that the GitHub page was taken down. Closing the code did not recall the copies already out there. BleepingComputer reported that English- and Korean-language derivatives built from the code remain available as they were.

The October 7 case involves an actor CrowdStrike does not name. The October 29 report covers VAPOR PANDA, and every number in the rest of this article comes from that second report.

What is AI hacking? How ARTEX splits an intrusion between agents

AI hacking, in ARTEX's case, means splitting an intrusion into jobs and handing each job to a different AI agent. According to CrowdStrike, a main agent coordinates subordinate planner agents and worker agents, and all of them share a graph of facts, findings and goals.

Think of it as a small crew with one project manager. The main agent is the manager. Planner agents decide what should happen next. Worker agents do the hands-on steps. The fact graph is the shared whiteboard: when one worker learns something about a network, that finding is written down where every other agent can read it, and it can become the next goal.

ARTEX calls each engagement a "task", and CrowdStrike says the agents move a task from initial access through host reconnaissance and lateral movement. In plain terms, that means getting a first foothold, looking around the machine that was breached, and then reaching other machines on the same network. Those are the same stages a human intruder works through.

Two figures from the report give a sense of scale. CrowdStrike says a single ARTEX controller was used against more than 200 distinct organizations, and that planning agents in a single intrusion consumed roughly 1.4 billion input tokens. A token is a small chunk of text that a language model reads, so that is a very large volume of text fed to the planners for one intrusion.

Can AI hack by itself?

AI did not hack by itself in the campaign CrowdStrike describes. CrowdStrike found that a human operator steered the agents at decision points, with instructions written in Chinese, labeled "human instruction" and timestamped in China Standard Time.

In CrowdStrike's account, the agents handled the legwork: tracking findings, planning next moves and carrying out the steps. The human stepped in at the decision points. The operator is still needed, but the job shifts from doing every step to steering.

What CrowdStrike describes is supervised automation, with a person making the key calls.

AI for hacking at scale: what CrowdStrike verified

Here is what CrowdStrike says it saw in the VAPOR PANDA campaign, figure by figure.

CrowdStrike lists the targets as foreign ministries, government bodies, think tanks, and organizations in pharmaceuticals, semiconductors, defense, nuclear, finance and telecoms. The single engagement against 19 U.S.-based organizations, CrowdStrike says, covered pharmaceutical, semiconductor, defense, nuclear and financial sectors.

The confirmed intrusions are the nine where CrowdStrike says the adversary deployed a tool called BLOODALCHEMY and carried out follow-on activity. The password-spraying and credential-scanning against at least 12 more organizations are login attacks, and CrowdStrike lists them separately from the nine confirmed cases. Everything else in the 200-plus count is targeting.

Can AI hack websites?

The CrowdStrike findings covered here do not single out website hacking. They describe ARTEX going after whole organizations, with agents that move from initial access through host reconnaissance and lateral movement. One of CrowdStrike's five recommendations, patching internet-facing appliances, does cover systems exposed directly to the internet.

Most of CrowdStrike's list deals with what happens after a first foothold: credentials, cloud permissions and monitoring.

On the defensive side of the same debate, our explainer on Gemini 4 Carbon covers why Google's new AI goes to defenders first. For the agent idea outside security, see how computer-use agents are learning to click and type like a human.

How do you defend against an AI cyber attack?

You defend against an AI cyber attack like this one with the five steps CrowdStrike lists in its report. None of them is exotic.

1. Rotate secrets after suspected exposure. CrowdStrike says to rotate signing keys, preauthentication keys and service credentials. A key that may have been seen should stop working.
2. Tighten identity and cloud settings. Enforce SAML signature validation, require IMDSv2 and limit the permissions cloud roles have to execute commands. SAML handles single sign-on, and IMDSv2 is the newer, harder-to-abuse version of the cloud metadata service that tells a server about itself.
3. Hunt for ARTEX markers. CrowdStrike lists "artx" or "artex" in command lines, cloud roles with an artx prefix, "art18-" comments, and the folder C:\ProgramData\artx5v\.
4. Patch internet-facing appliances. These are devices exposed directly to the internet, such as VPN gateways and firewalls.
5. Deploy a real-time EDR agent across the environment. EDR (endpoint detection and response) software watches each machine for suspicious behavior as it happens, so coverage gaps are blind spots.

The list is short on AI-specific measures. Apart from the ARTEX markers, it is ordinary identity, cloud and patching hygiene.

AI cyber attacks in 2026: what to watch next

CrowdStrike expects the trend to continue. The company assesses it is "highly likely" that China-nexus adversaries will keep adopting agentic frameworks like ARTEX over the next 12 months.

Three open questions remain. First, whether CrowdStrike or other researchers identify the second commercial LLM in the VAPOR PANDA campaign. Second, whether CrowdStrike updates the nine confirmed cases. Third, whether the ARTEX derivatives that BleepingComputer says remain available turn up in new campaigns.

For defenders, the lesson of this AI for hacking case is practical: CrowdStrike's five steps, from rotating keys to full EDR coverage, are where to start.