Hacking at Machine Speed: Microsoft Ties a Chinese State-Aligned Group to an AI Attack Tool

On October 21, Microsoft reported that Storm-0940, a hacking group it describes as aligned with the Chinese state, used ARTEX, a free AI agent framework for probing computer systems, to automate attacks on hundreds of organizations. In some cases the group reached privileged cloud access in under three hours, and Microsoft assesses it was behind the ConnectWise Cloud Backup breach. The case suggests AI tools are shortening the time defenders have to respond. In this episode What ARTEX is, and why it works with any AI model plugged into it Microsoft's three findings: sub-three-hour break-ins, a 151,000-attempt password-guessing campaign, and stolen backup-service credentials used against more than 2,250 Microsoft 365 environments Why safeguards built into a single AI model can't cover this kind of misuse Caveats: attribution is Microsoft's assessment, most attempts failed, humans directed the tool, and the techniques themselves are old Bottom line A state-aligned group used a free AI agent framework to attack at a speed human defenders struggle to match. Key details are not public, but the report adds to evidence that model-level safeguards alone can't address AI-assisted hacking. Sources and further reading Microsoft Threat Intelligence: Storm-0940 uses ARTEX in ConnectWise supply chain compromise (Oct 21, 2026) ConnectWise: Cloud Backup security advisories (update of Oct 21, 2026) CSO Online: China-linked hackers used agentic AI in attack on 2,250 Microsoft 365 tenants Daily AI Safety: Did AI Help Hack Korea's Banks? (Oct 10, 2026) This post was written by Claude and fact checked by Nathan Nguyen.