Every bank robbery carries the same arithmetic: casing the joint takes longer than the job. The surveillance, the schedules, the shift changes, the delivery routes; weeks of patience folded into minutes of action. The ratio held for a century of heists and for most of the history of computer intrusion, where a competent intrusion engagement ran for weeks and the exploitation itself was an evening. On October 21, Microsoft published an account of a campaign that breaks the ratio on the other end.^[1] A state-aligned espionage crew armed itself with an open-source agentic AI pentest framework, pointed it at hundreds of organizations, and in multiple documented cases went from first probe to privileged cloud access in less than three hours. The casing was folded into the job. The report does not say a machine did the spying; it says something quieter and worse, that the machine did the legwork, all of it, at once, and never got tired.

The tenant from Beijing

The crew is tracked as Storm-0940, a China-state-aligned actor Microsoft has watched since 2021, working data theft across multiple industries. Its tradecraft before this year was unglamorous and effective: password spraying against login portals, exploiting unpatched internet-facing applications, then persisting in cloud tenants by adding its own credentials to existing OAuth applications and reading the tenant through Microsoft Graph like a landlord with a master key.^[1] Nothing in that profile required artificial intelligence. It required patience, and patience was the one ingredient defenders could price. A human team sprays passwords at human speed, works one target cluster at a time, rests on weekends, and leaves the operational rhythm that detection engineers have been tuning dashboards to catch for twenty years.

ARTEX and agentic AI pentesting

The framework is called ARTEX, an open-source penetration testing framework that can use any AI model to automate offensive security workflows.^[1] It is a multi-agent system written in Go with a Next.js interface, and its default language is English, switchable to Korean, Mandarin, Spanish or Japanese. Describe a target and it runs the engagement the way a consultancy would: reconnaissance, enumeration, vulnerability discovery, exploitation, post-exploitation, data exfiltration, with minimal human interaction. It accumulates what it learns into a graph of assets and weaknesses, so the twentieth hour of an engagement knows what the first hour found. It is, in other words, the institutional memory of a penetration testing team, minus the team, available to anyone who can read a README.

Offensive tooling going public is not new. H.D. Moore released the first version of Metasploit in 2003 and the industry absorbed the shock; exploit frameworks became commodity infrastructure, and defense adapted.^[2] The difference is the operator. Metasploit still needed a person to aim it. ARTEX points itself, and the model decides what to try next from what the last attempt returned. The skill ceiling of intrusion did not lower; it evaporated for the parts of the job that were ever about effort rather than judgment.

The campaign by the numbers

Microsoft attributes the campaign to Storm-0940 using ARTEX as early as September 2026, against hundreds of organizations globally: aerospace and defense, automotive, chemicals, energy, financial services, government, legal, manufacturing, media, military, semiconductors, software, think tanks and non-profits.^[1] The volume statistics read like a misconfigured load test. In one documented sequence, four days of password spraying from a single address hit 327 accounts across eight organizations and generated more than 151,000 failed sign-ins, peaking at 2,900 failures per minute, over 111,000 in a single day, with roughly 98 percent of attempts ending in lockout. More than 2,250 tenants were attempted in total. In one burst, over 200 sign-ins landed within four minutes, driven by four application credentials working in rotation.

The lockout rate is the tell. Ninety-eight percent failure is either incompetence or indifference, and a framework that automates attempts does not mind failing ten thousand times, because failing is free. Human intruders budget their noise. Agents spend it, and the noise floor of the internet went up accordingly.

The supply chain in the middle

The password spraying failed, and it did not matter. The way into the tenants ran through a vendor. ConnectWise, whose Cloud Backup service, formerly SkyKick, sits inside thousands of Microsoft 365 environments as a trusted application, disclosed unauthorized access to application identities in its own environment on October 16.^[3] Once Storm-0940 acquired control of those application identities, the ARTEX-driven agents did not need to authenticate as anyone. They authenticated as the vendor, taking advantage of the trust that thousands of tenants had already extended to the application, and walked into customer environments through a door the customers had installed themselves.^[1]

From inside, the agents worked Microsoft Graph the way the crew always had, at a tempo no crew ever managed: reconnaissance of directories, modification of application credentials to plant persistence, changes to groups and roles. The persistence detail deserves a slow read. The backdoors lived as credentials added to existing trusted applications, so they survived even after the originally compromised application was remediated; and in multiple instances the agents assigned themselves the Global Administrator role, the keys to the entire tenant, before anyone had finished reading the first alert. Microsoft’s summary sentence is the one to frame: the time from initial targeting to privileged access was, in several cases, less than three hours.^[1]

What machine speed does to defense

An intrusion that completes in three hours does not outrun your tools; it outruns your calendar. The median security operations center triages alerts in hours and investigates in days. A human-paced attacker leaves a week of dwell time and a trail of sessions at human intervals, nights included but weekends sparse. An agent-paced attacker compresses the entire kill chain into a single afternoon and then, having achieved persistence, slows down to the speed of an ordinary service account, at which point the fast intrusion has become a slow one with better paperwork. Microsoft’s phrasing is precise: agents are not constrained by factors affecting humans, they work around the clock, on weekends and holidays, and attempt multiple breach paths simultaneously.^[1]

The uncomfortable corollary is that the defender’s advantage was never the tools. It was that attacking is expensive and attackers have to sleep. Neither holds anymore. The cost curve of offense just moved, permanently, and every budget that assumed human-paced adversaries is now calibrated against a ghost.

What defenders should do on Monday

The response guidance is concrete, and worth compressing to a checklist. If your tenant connects to ConnectWise Cloud Backup, disable the application connections until the vendor formally restores them, but do not delete the enterprise applications first, because deletion burns the evidence you will want for the forensics.^[1] Inventory the affected application IDs Microsoft published. Review Entra sign-in and audit logs from at least October 15, and pull October 1 while you are at it. Audit credential additions to service principals, consent grants, and role assignments, with an eye on anyone who is not a Global Administrator holding Global Administrator. And the general lesson outruns this vendor: every multi-tenant application your tenant trusts is a supply chain node, and its permissions deserve the same scrutiny you give your own administrators, because an attacker who owns the vendor does not need your password, only the vendor’s blessing.

The case for the defense

There is a version of this story where the moral is that AI broke security, and the report itself argues against it. The majority of the targeting was not successful, as Microsoft states without decoration.^[1] The spray failed; the lockouts held. What worked was not the model but the tenancy model, the quiet certainty that thousands of organizations will forever trust a vendor’s application more than they audit it. That vulnerability predates ARTEX, would have worked for a patient human crew with stolen vendor credentials, and was in fact the same class of failure as a dozen supply chain incidents before it. The framework made it faster and wider. It did not make it possible.

The honest conclusion sits between the alarms. Agentic offense did not invent this breach; it industrialized it, and industrialization is a forecast, not a verdict. The same automation aimed the other way is already triaging alerts and enumerating exposures for defenders. What changed this month is the exchange rate between effort and access. Three hours from probe to Global Administrator is the new quote, and every security team should price its response accordingly.

The scan now runs at machine speed. Trust still moves at human speed.

---

1. Microsoft Security Blog, Storm-0940 uses ARTEX agentic AI and a ConnectWise supply-chain compromise for cloud intrusions (October 21, 2026). The three-hour figure: “including multiple instances where the time from initial targeting to privileged access was less than 3 hours”; “Agents are not constrained by factors affecting humans - they can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously”; “While the majority of the targeting wasn’t successful, Storm-0940 achieved privileged cloud persistence at many organizations in a brief time”; the actor “used ARTEX to accelerate the activity to machine speed”; 2,250+ tenants attempted, 151,000+ failed sign-ins from 144.172.64[.]99 across 327 accounts in 8 orgs, peak 2,900 failures/minute, ~98% lockouts; affected application IDs 506e08f9-6e9a-4da4-942b-a099a03644ae (Cloud Backup), 24205314-2b89-4e07-a2a4-579e898a5640 (MS Teams), 0de14c77-b9b0-4137-9360-34878a929827 (MS Graph).
2. H.D. Moore released the first public version of Metasploit in 2003; the project’s history of turning exploit development into portable framework code is documented at metasploit.com. The 2003 release predates its acquisition by Rapid7 (2009) and open-sourcing under a BSD licence.
3. ConnectWise, Trust Center advisories (advisory first published October 16, 2026, 17:47 UTC): “unauthorized access to application identities within the ConnectWise Cloud Backup environment”; Cloud Backup formerly known as SkyKick. Huntress documented the compromised vendor API secret being used against customer Microsoft 365 tenants the same day, and BleepingComputer reported the supply-chain breach mechanics.