An AI attack framework went after 200+ organizations; nine are confirmed breached
- At a glance: AI attack framework ARTEX hit 200+ organizations, 9 confirmed intrusions
- Date: 2026-10-30
- Reported by: The Hacker News
- Status: Source: The Hacker News relaying CrowdStrike and Zscaler analysis. 200+ organizations were targeted, not all breached; nine are confirmed. The model used is unidentified.
- Last checked: 2026-10-31
On October 30, 2026, The Hacker News reported CrowdStrike's analysis that a China-based actor it tracks as Vapor Panda has used ARTEX, an AI-powered penetration testing framework, against more than 200 distinct organizations worldwide since October 17.
Post-exploitation activity was confirmed at nine organizations, where the attacker deployed BLOODALCHEMY, a derivative of ShadowPad.
CrowdStrike says that in a single intrusion, Vapor Panda's planning agents consumed on the order of 1.4 billion input tokens. Zscaler ThreatLabz says ARTEX orchestrates multiple LLM backends to perform reconnaissance, vulnerability identification and exploitation on its own.
The report notes a human operator still oversees the operation, and the subscription-based commercial model behind it has not been identified.
Source: The Hacker News relaying CrowdStrike and Zscaler analysis. 200+ organizations were targeted, not all breached; nine are confirmed. The model used is unidentified.
Sources
Find this archive useful? Supply the resistance ♥
See today's AI threat brief →