On October 17, 2026, a single controller began aiming an AI agent framework at other people’s networks. Eleven days later, the target count stood above 200 organisations in at least 14 countries. The framework is open source. The models behind it were commercial products. A human operator steered the work at the decision points.
The direct answer: two separate crews used AI help to run intrusions at machine pace in October. One campaign aimed agents at more than 200 organisations and reached deep inside nine of them. A second crew chained two public bugs to take root control of 25 servers, most of them firewalls. Neither crew needed a new exploit. Both needed defenders who had left old doors open. The defence is patch order and closed management interfaces, not a bigger tool stack.
One controller, many front doors
The framework is called ARTEX. A main agent directs planner and worker agents over a shared graph. The graph holds facts, findings and goals for each target. The agents advance each intrusion from first access toward lateral movement. They pursue several attack paths at once. When one path fails, they shift to another.
The campaign ran mainly on DeepSeek. A second, subscription-based commercial model sat beside it. The trackers could not confirm which one. In a single intrusion, the planning agents consumed about 1.4 billion input tokens. That figure covers one target. The whole operation implies far more.
The targets were not random. Foreign ministries in Latin America, Europe, Asia and the Middle East. Semiconductor, defence and think tank organisations in the United States. Telecom providers in several regions. One engagement worked through a single European country’s foreign ministry, presidency and prime minister’s office.
Depth is the number to hold beside the reach. The trackers confirmed post-exploitation activity at nine organisations. There, the crew installed a backdoor, sprayed credentials and scanned the network. Password spraying touched at least 12 more organisations. The agents also inventoried which machines lacked endpoint sensors. Follow-on work concentrated on the unprotected hosts.
One engagement shows the tradecraft plainly. The operator handed the agents a 2022 directory export from a Greek government mail server. The authentication keys inside it had never been rotated. The agents forged an administrator token and read mailboxes. They then used a leaked VPN setup to reach the internal network. The newest tooling in the campaign still fed on the oldest hygiene failure.
This campaign is not the framework’s only outing. A separate ARTEX operation ran under a different actor designation in the same season. The trackers read that as a pattern, not a one-off. Agent frameworks now move between crews the way exploit kits always have.
The second crew came through the firewall
A separate operation surfaced through artifacts the operator left on its own infrastructure. This crew fingerprinted about 19,000 firewall management interfaces facing the public internet. The chain that followed needed two public bugs and one request. Two memory flaws in PHP’s request handling, each rated 9.2 out of 10, gave code execution on the firewall’s management web server. A Linux kernel privilege flaw then raised that access to root. No password was needed at any step.
The bugs were never secret. PHP shipped its fixes on October 21, across four release branches. US authorities added the kernel flaw to the known-exploited list on October 28. Independent verification of the tooling and the results came from the firewall maker’s own threat unit. The final count was 25 rooted servers across four countries. At least one set sat inside a US government-affiliated environment.
The operator’s machine held the AI evidence. A commercial coding agent was installed. An offensive platform called aiscan was set to two Chinese models, DeepSeek and Kimi. About 40 post-exploitation scripts shared a consistent style. That consistency suggests AI help in writing them.
What the evidence does not show
Two hundred targeted is not two hundred breached. Nine deep intrusions are confirmed. The gap between those numbers is the story’s centre. Any report that merges them is selling scale the evidence does not carry.
AI-assisted is not AI-run. The researchers state plainly that they hold no direct evidence the AI wrote the exploit code. A person directed both operations and intervened at the choices that mattered. The tooling was also ordinary. An open-source framework. Paid model subscriptions. Public bugs with public fixes. Nothing in either kit needed a research lab.
Your own shop runs the same class of tooling for honest work. One Claude Code setting leaked 1,379 passwords and keys. The check takes 10 minutes shows how fast an agent setting becomes an exposure. The agent is not the risk by itself. The open door beside it is.
The patch order for a Canadian firm
First, get every management interface off the public internet. Firewall. VPN box. Storage array. Phone system. If an admin page answers a stranger’s request, that is the finding. The firewall maker’s own guidance says the management interface should not face the internet at all.
Second, patch internet-facing appliances before laptops. Laptops update themselves overnight. Appliances wait for a person to schedule them. Small business patching in Canada needs a faster clock sets a 48-hour bar for that short hand-patched list. Eleven days is now a full campaign window. A two-week queue is an open invitation.
Third, know which rules actually cover your systems. Canada’s critical cyber law skips hospitals as the UK warns of AI ransomware shows which sectors the new federal law reaches and which it leaves out. Most firms sit outside it. They hold their own clock, and nobody sets it for them.
Fourth, decide who signs when an agent acts inside your systems. The buying side already faces this question. Who signs an AI agent refund after Ada joins Dialpad? asks it about refunds. The security version asks who approves an agent’s access in the first place. Both need a name, in writing, before the incident.
Fifth, rotate the keys that sit in old exports and backups. Directory exports, mail archives and setup files from years ago still hold working credentials. One engagement in this campaign ran on keys from 2022. A key that never expires is a door that never closes.
Run one test this week. Scan your own public address space from outside, the way a stranger would. List every login page and management interface the scan finds. Any entry your team cannot name gets closed or patched first, before the next laptop update cycle. No hands-on intrusion test ran for this piece. The scan runs on your own network, with your own permission, or not at all.
