AI agents probe endpoint blind spots

The intrusion task was mundane: list running processes, list folders, check whether a particular security sensor was present. What made it different at a global pharmaceutical company was who — or what — carried it out. According to CrowdStrike, a China-linked group tracked as VAPOR PANDA directed AI agents to perform that reconnaissance on Windows machines, using the results to determine whether CrowdStrike's Falcon sensor was installed. The answer would tell the operators whether the machine was watched.

The finding sits inside a larger campaign CrowdStrike reported against more than 200 organizations worldwide over an 11-day span beginning October 17. Government agencies and businesses across at least 14 countries were targeted, with researchers confirming post-exploitation activity at nine. The tool behind it, an AI-powered penetration testing framework called ARTEX, is the part drawing the most attention.

Inside the ARTEX framework

ARTEX is built to run multiple AI agents that carry out intrusion tasks under human direction. CrowdStrike found VAPOR PANDA using it to pursue attacks against several organizations at once, with operators stepping in at key decision points rather than driving every step by hand.

The framework was run with DeepSeek and a second commercial AI model, according to CrowdStrike. The developer withdrew the original open-source project in October after reports of misuse, but copies and modified versions remain available — a detail that matters for anyone assuming the tool has been taken off the board.

At the Greek government organization targeted in the campaign, the entry point was anything but novel: attackers used authentication keys from a 2022 directory export that had likely never been rotated. At the US pharmaceutical company, an AI agent combined an unsigned SAML assertion with an XML external entity (XXE) vulnerability to obtain a cloud role with extensive administrative permissions.

Parallel attacks, smaller teams

The techniques in these intrusions are old. What changed, according to analysts who reviewed the findings, is the ability to run them concurrently without adding headcount. Akshat Tyagi, associate practice leader at HFS Research, framed the shift plainly.

“The techniques are familiar, but the ability to run them in parallel is not,” Tyagi said.

— Akshat Tyagi, associate practice leader at HFS Research

Jonathan Ong, senior analyst for managed security services at Omdia, said AI can substantially reduce the time attackers spend on reconnaissance, even as more sophisticated exploitation still demands technical expertise. The division of labor matters: automation compresses the boring, time-consuming front end of an intrusion while the hard parts remain human work.

CrowdStrike's account suggests the human element has not disappeared. Operators intervened at decision points throughout the campaign, and the agents executed tasks under their direction rather than acting on their own initiative.

A second campaign, same tool

The CrowdStrike findings follow an October 21 report from Microsoft describing a separate campaign involving ARTEX. Microsoft said another China-linked group, Storm-0940, used the framework to automate attacks against hundreds of organizations, gaining privileged cloud access in less than three hours in some cases. That campaign included abuse of compromised ConnectWise application credentials to reach customer environments.

In research published in October, Google Threat Intelligence Group and Mandiant said they had observed financially motivated attackers using ARTEX during data-theft extortion operations, alongside its use by suspected state-linked groups. Three separate reporting efforts now describe the same framework in the hands of different actors with different motives.

Coverage gaps become the target

The pharmaceutical case is instructive because the AI agents were not looking for a clever flaw. They were checking whether the endpoint was monitored at all. A machine without the sensor is a machine where subsequent activity may go unseen, and the agents were tasked with finding those machines.

Amit Kumar Jena, development manager for AI at Kanerika, said organizations should continuously measure endpoint protection coverage, including on internal servers, and generate alerts when machines stop reporting to security monitoring systems. He also recommended enforcing SAML signature validation and restricting cloud access privileges.

Security teams should watch for closely sequenced authentication attempts and commands that could indicate automated malicious activity, Jena said. That pattern — rapid, orderly sequences rather than the messy meandering of a human intruder — is one signature of agent-driven operations.

The rotation problem persists

The Greek government intrusion rests on a failure that predates any AI tool by years. Credentials exported in 2022 were still valid when attackers used them, suggesting the keys had not been rotated in the interim. Tyagi recommended regularly rotating credentials and monitoring unusual account activity, warning that automated attacks leave defenders less time to investigate suspicious behavior.

The SAML and XXE combination at the US pharmaceutical company points at a different kind of gap: two separate weaknesses, neither sufficient alone, chained by an agent that found the path between them. The result was a cloud role with extensive administrative permissions.

Keith Prabhu, CEO of Confidis, said gaps between security systems could give attackers opportunities to move through enterprise environments. He recommended improving asset visibility and detecting suspicious activity across systems rather than relying on individual security controls.

Where the numbers land

The scale of the two campaigns, as reported, comes down to a handful of figures:

• 200-plus organizations targeted in the CrowdStrike-observed campaign
• 11 days of activity beginning October 17
• At least 14 countries affected, with post-exploitation activity confirmed at nine
• Privileged cloud access achieved in under three hours in some Storm-0940 cases, per Microsoft
• Keys from a 2022 directory export used at the Greek government organization

The Microsoft report on Storm-0940 was published October 21. CrowdStrike's account of VAPOR PANDA's campaign does not carry a comparable single publication date in the source material.

The Cobalt Strike comparison

ARTEX's appearance across multiple threat groups points to a broader question about how widely such tools will spread. Tyagi expects adoption by financially motivated cybercriminals to grow over the next 12 months. The Google and Mandiant research already documents that crossover happening.

Ong drew the comparison that frames the debate.

“AI pentesting frameworks such as ARTEX have the potential to become the Cobalt Strike of the AI era,” said Ong.

— Jonathan Ong, senior analyst for managed security services at Omdia

Cobalt Strike, a commercial penetration-testing tool, has been widely abused by cybercriminals and state-sponsored groups. The parallel is about availability and misuse, not capability: a legitimate tool whose copies circulate far beyond the people licensed to use it.

Automation meets automation

As attackers automate more of their operations, security teams may need to lean more heavily on automated detection. Tyagi said this would let analysts spend less time manually reviewing alerts and concentrate on decisions that require human judgment.

Prabhu argued that CISOs should prioritize faster, rehearsed incident response rather than simply buying more AI tools or expanding security teams. Preparation of that kind could help when automated agents are exploring multiple attack paths before defenders have finished their initial investigation — a scenario in which the intruder may already be several steps ahead by the time a human opens the ticket.

Despite the automation, the observed campaigns still involved people directing key decisions. Tyagi was direct about the current state of play.

“We are not at fully autonomous attacks yet,” Tyagi said.

— Akshat Tyagi, associate practice leader at HFS Research

What it means for defenders

The continuing role of human operators does not slow the attacks down, and that is the uncomfortable part for security leaders. If agents can check hundreds of endpoints for a missing sensor in parallel while an analyst is still working through the first alert, the advantage shifts toward whoever can detect the probing itself — not just the intrusion that follows. This suggests coverage verification and alerting on machines that go dark may matter as much as the detection rules tuned to catch known techniques.

The reuse of unrotated 2022 credentials and the chaining of an unsigned SAML assertion with an XXE flaw point to a similar conclusion: the gaps being exploited are often ones organizations already know about and have simply not closed. Automated adversaries compress the window between discovery and exploitation of those gaps, which could make basic hygiene — credential rotation, SAML signature validation, restricted cloud privileges — the difference between a blocked attempt and a confirmed compromise.

Whether ARTEX becomes the Cobalt Strike of its era is not settled. What the two campaigns described so far indicate is that the tooling is already in more than one set of hands, and that the organizations most exposed may be the ones that cannot say with confidence which of their machines are actually reporting in.