A China-linked hacking group directed swarms of AI software agents against government ministries, pharmaceutical companies, semiconductor firms, defence contractors, and other organisations across 14 countries — targeting more than 200 of them in roughly 11 days. The campaign, documented in detail by CrowdStrike on 29 October 2026, is one of the most consequential documented cases of AI-assisted offensive cyber operations to date.

The headline numbers require care. The 200-plus figure is a count of organisations targeted, not a count of confirmed breaches. CrowdStrike confirmed post-exploitation activity — meaning it observed the attackers operating inside a network after gaining access — at nine organisations. It also recorded credential-scanning and password-spraying activity against at least 12 more, and described preparatory targeting files for prospective operations beyond those. The public report does not establish that all 200-plus were compromised, that data was stolen from each, or that any suffered physical disruption.

Who VAPOR PANDA is, and what ARTEX does

CrowdStrike attributes the campaign to a group it calls VAPOR PANDA, which it has tracked since 2021 as a China-nexus targeted-intrusion actor whose established mission includes developing long-term access to sensitive organisations. This is a threat-intelligence attribution — not public proof that the Chinese government directed this specific operation. CrowdStrike describes the campaign as the group’s first observed use of AI-driven intrusion tooling, meaning first observed by CrowdStrike, not necessarily the first time the group has used AI at all.

ARTEX is not itself an AI model. It is an orchestration framework — software that connects one or more language models to a task manager, a shared memory graph, and a toolkit of offensive capabilities. Microsoft’s separate analysis describes it as a Go-based, multi-agent system with a Next.js front end designed to automate penetration-testing workflows. CrowdStrike’s account describes a main agent coordinating planner agents and worker agents over a shared graph of discovered facts and goals: planners break an engagement into subtasks; workers execute them; findings from one step inform the next.

In VAPOR PANDA’s campaign, ARTEX ran primarily on the DeepSeek large language model, supplemented by a second commercial model that CrowdStrike could not identify. There is no public evidence that either model provider knew about or participated in the attacks.

A human operator was steering every step

This is not a story about an AI acting on its own initiative. CrowdStrike recovered transcripts showing Chinese-language instructions marked as human input throughout the operation. One translated instruction reads: “find Windows machines in the domain without Falcon, judging by tasklist and folder listings.” The operator was deliberately directing agents to identify hosts that lacked CrowdStrike’s own endpoint sensor — building gaps in defensive coverage into the attack workflow.

The agents could carry out many steps between those interventions, but the operation is best described as human-steered and highly automated, not autonomous. CrowdStrike’s senior vice-president of counter adversary operations, Adam Meyers, told CyberScoop that the attacks were not showcasing anything new: “it’s just doing it at a speed and scale that we’re unaccustomed to.”

That speed is striking. CrowdStrike observed ARTEX activity exceeding 1,500 commands per hour in this campaign, compared with up to 40 commands per hour in its historical observations of hands-on-keyboard human operators. Meyers also said roughly 70% of targets were either confirmed compromised or had evidence consistent with a successful intrusion at moderate confidence — but that figure comes from a CyberScoop report of a CrowdStrike statement, not the primary published report, and the moderate-confidence category is not defined publicly. It should not be read as 70% confirmed breaches; nine confirmed post-exploitation cases remains the clearest public number.

What the confirmed intrusions actually involved

The attacks used established vulnerabilities and techniques — not anything invented by the AI model. Three examples from CrowdStrike’s report illustrate the method:

At one US pharmaceutical organisation, an agent combined a weakness in SAML authentication with an XML external entity (XXE) processing flaw to reach a cloud instance-metadata service. This exposed credentials for a cloud role capable of issuing administrative commands to thousands of instances. CrowdStrike says the chain later led to recovery of an enterprise administrator account. The report describes the role’s potential reach but does not say all those instances were controlled or that data was exfiltrated from all of them.

At a second US pharmaceutical organisation, agents deployed web shells, exploited an unauthenticated orchestration service to gain root access in a production container environment, read Local Administrator Password Solution (LAPS) passwords from Windows machines, and abused an Active Directory delegation feature to impersonate a privileged account. The published report does not quantify resulting data theft.

At a Greek government entity, the human operator supplied a 2022 mail-server directory export containing authentication keys that CrowdStrike believed had probably not been rotated. The agents used those keys to forge an administrator token and read mailboxes. The operator also mentioned VPN credentials from a 2024 email leak. This example combines automation with human-provided, historically exposed material — the AI did not independently discover those secrets.

CrowdStrike also documented deployment of BLOODALCHEMY, a backdoor first publicly analysed by Elastic Security Labs in 2023, at a Middle Eastern interior ministry and a Latin American foreign ministry. The loader used a legitimate binary renamed svchost.exe to load a malicious DLL and decrypt the payload. BLOODALCHEMY is not an AI system; it is a conventional persistence and communications implant.

Sectors and scale — with important caveats

CrowdStrike reports that one engagement targeted 19 US-based organisations across pharmaceutical, semiconductor, defence, nuclear, and financial sectors. That the nuclear sector appears among the targets is worth noting — but the public report does not identify an operational nuclear facility, describe access to nuclear operational technology, or report any disruption to nuclear operations. The activity described is cyber intrusion and espionage-oriented access development.

CrowdStrike estimated that planning agents consumed approximately 1.4 billion input tokens during one intrusion. That figure is evidence of extensive model usage, not a direct measure of reasoning quality, successful actions, or human labour replaced. The report does not publish enough accounting detail to show how many of those tokens represented novel analysis versus accumulated task context.

A separate campaign, and a spreading tool

The VAPOR PANDA operation is distinct from a separate campaign Microsoft attributed on 21 October 2026 to Storm-0940, another China-state-aligned group. Microsoft’s report describes Storm-0940 using ARTEX in activity that included a ConnectWise Cloud Backup supply-chain compromise, with multiple cases reaching privileged cloud access in under three hours. CrowdStrike explicitly distinguishes that activity from VAPOR PANDA’s campaign. The fact that two separate groups used ARTEX supports the conclusion that the framework was spreading among different operators; it does not show that those actors coordinated.

The tool’s availability has a complicated history. On 8 October 2026, the developer — operating under the GitHub account Autumn-27 — announced ARTEX would stop receiving public updates and become closed-source, citing malicious misuse. VAPOR PANDA’s campaign began nine days later. Closing the repository did not revoke copies already downloaded or forked. Google’s Threat Intelligence Group and Mandiant and Check Point Research both describe ongoing proliferation through forks and alternate versions. Check Point observed 1,608 live, publicly accessible ARTEX instances in its own measurement — a snapshot, not a census of all deployments or a count of unique attackers.

Separately, Zscaler documented an ARTEX-assisted campaign against South Korean financial institutions that resulted in the theft of personal information belonging to approximately 67,000 people. That operation is not connected to VAPOR PANDA.

What the evidence does — and does not — support

The NCSC’s November 2026 assessment states that AI is highly likely to accelerate and scale existing tactics, while human operators are likely to remain important in directing and validating operations. That framing fits what CrowdStrike observed: ARTEX did not invent a new class of attack; it let one operator team delegate familiar techniques across a much larger set of targets at machine speed.

Google GTIG/Mandiant’s review of multiple ARTEX-related incidents adds a useful counterpoint: the framework’s rapid, trial-and-error approach can be forensically noisy, leaving defenders logs and detectable artifacts. As Google put it: “Frameworks such as ARTEX compress attack timelines to machine speed; however, they currently trade stealth for velocity.” In a separate incident set, Google observed a burst of 27 events in 23 seconds — fast, but not invisible. That observation is from different investigations, not from VAPOR PANDA’s campaign specifically.

This is a serious case of AI-enabled cyber misuse. It is not evidence of an AI model acting without human direction, developing its own objectives, or deceiving its operator. The safety concern is that a malicious operator can use AI-assisted orchestration to scale and adapt attacks — not that the AI initiated them.

The clearest evidence-based response is cybersecurity practice: rotate exposed credentials, enforce SAML validation, require IMDSv2 on cloud metadata services, limit cloud-role permissions, patch internet-facing systems, extend endpoint coverage, and monitor for anomalous behaviour across identity, cloud, and API activity. CISA and international partners have issued guidance for organisations deploying their own AI agents, warning of expanded attack surfaces and privilege creep — advice about securing agent deployments, not a finding that ARTEX itself behaved unpredictably in this incident.

As of the reporting reviewed here, the campaign was still active on 30 October 2026 according to CyberScoop. No later public statement reviewed for this article confirms when it ended or provides a final count of affected organisations.

Sources and method