Hackers Aimed AI Agents at 200+ Organisations in 11 Days

CrowdStrike says a single ARTEX controller targeted more than 200 organisations in at least 14 countries over an 11-day window beginning 17 Oct 2026 (CrowdStrike). The adversary behind it, which CrowdStrike calls VAPOR PANDA and describes as China-nexus, ran the framework mainly on DeepSeek plus a second subscription-based commercial model that CrowdStrike could not confirm. The targets included foreign ministries, US semiconductor, defence and think tank organisations, telecoms and pharmaceutical firms. CrowdStrike's assessment is that agentic tooling like this lets a small team pursue a wider target set than manual operations would support.

TL;DR

• ARTEX is an open-source multi-agent intrusion framework: a main agent coordinates planner and worker agents over a shared graph of facts, findings and goals.
• One controller hit more than 200 organisations in at least 14 countries in 11 days.
• CrowdStrike confirmed post-exploitation at nine organisations and credential spraying against at least 12 more.
• The successful techniques relied on unsigned SAML assertions, unrotated keys from a 2022 export, and an unauthenticated orchestration service.
• The defensive list is ordinary security hygiene, and it is cheaper than an incident.

Disclosure: ZeroRaised publishes this analysis and is a launch site for bootstrapped products. Facts come from the linked sources as checked on 31 Oct 2026; ZeroRaised has no commercial relationship with the companies named.

Agent-scale intrusion is an attack in which an AI agent framework plans and executes many parallel attack paths across many targets from a single controller, with a human operator steering at key decisions.

What did VAPOR PANDA actually run?#

CrowdStrike describes ARTEX as an open-source multi-agent intrusion framework. It coordinates a main agent with planner and worker agents over a shared graph of facts, findings and goals, and a human operator steered it at decision points (CrowdStrike). The agents pursued multiple attack paths in parallel and switched approaches when one failed. In one case the operator told the agents to find Windows machines without the CrowdStrike Falcon sensor installed.

That is the part founders should sit with. The system was not a magic exploit machine. It was a way to try many ordinary things at once, remember what worked and move on quickly. CrowdStrike says in a single intrusion, planning agents consumed on the order of 1.4 billion input tokens. Even at current model prices, that is a small sum next to the value of a network foothold. The economics of persistence have changed more than the economics of a single exploit.

CrowdStrike confirmed post-exploitation at nine organisations, including the BLOODALCHEMY backdoor, credential spraying, network scanning and reconnaissance. It also saw password spraying or credential scanning against at least 12 more (CrowdStrike). The spread between attempted and confirmed is the story: cheap attempts, repeated until something gives.

Why does agent-scale attacking matter for a small team?#

Most bootstrapped SaaS products are not foreign ministries. It is tempting to file this under news that does not apply. That would miss the mechanism.

The attacks CrowdStrike documented exploited configuration and credential failures, not exotic zero-days. An unsigned SAML assertion was chained with an XXE flaw to query the cloud Instance Metadata Service. An unauthenticated orchestration service was abused for root in a container environment. Unrotated authentication keys from a 2022 directory export were used to forge an admin token (CrowdStrike). None of those require a large security budget to prevent. All of them require someone to have looked.

Small teams accumulate the same debris: a key created for a migration and never revoked, a service account with broad permissions because narrowing it was fiddly, a staging container that can reach the metadata endpoint. An agent that can try a hundred variations overnight will find the one path you forgot.

CrowdStrike expects China-nexus adversaries to keep adopting agentic frameworks over the next 12 months (CrowdStrike). That is a forecast, not a guarantee, but it points in one direction: the cost of a broad, automated probe keeps falling.

What should you fix first?#

CrowdStrike's recommendations are short and unglamorous (CrowdStrike):

1. Rotate signing keys, preauthentication keys and service credentials after any suspected exposure. Include keys in old backups and exports, because keys from a 2022 export were used to forge an admin token in one intrusion.
2. Enforce SAML signature validation. An unsigned assertion should never be accepted, regardless of what else is configured.
3. Require IMDSv2 on cloud instances, so a server-side request cannot casually read instance credentials.
4. Restrict command-execution permissions on cloud roles. An agent or service that does not need to run commands should not be able to.
5. Patch internet-facing appliances and run endpoint detection and response on servers, not just laptops.

If you run agents inside your own product, add one more: give each agent its own credentials and scope. Do not hand an agent the same login a human uses. The agent sandboxing guide and the API key rotation guide cover the practical version of that advice, and the prompt injection guide explains why an agent that reads untrusted content needs a hard boundary around what it can do.

What this means for bootstrapped founders#

The uncomfortable takeaway is that agent-scale attacks do not require your attacker to care about you specifically. They require you to be findable and slightly untidy. A single old key, one permissive role or one unvalidated assertion is enough.

That argues for a short, repeated checklist rather than a security programme. Every quarter, list the keys and service accounts you have, delete the ones you cannot explain, and confirm that your SAML configuration rejects unsigned assertions. Check that your cloud metadata service requires IMDSv2. Check which roles can execute commands. This is an hour of work, and it is exactly the work that the ARTEX techniques punished the absence of.

It also argues for restraint with your own agents. If you are building an agent that deploys code or spins up servers, treat its credentials as a separate blast radius. Log what it does, keep a human approval step for infrastructure changes, and assume that anything the agent can read could end up somewhere you did not choose. Monitoring is not a nice extra here; it is how you find out before a customer does. The AI code review guide and the vibe-coded app security checklist are the other half of that habit.

None of this requires a security team. It requires that the boring controls are actually switched on.

Where ZeroRaised fits#

ZeroRaised is a launch and discovery site for products built without institutional venture capital or accelerator equity. If you have a product people can try, submit it here; the pricing page explains the current options. A launch page is a good place to say plainly how your product handles credentials and what your agents can and cannot do.

For more practical analysis, join the ZeroRaised newsletter. No promises of traffic or results, just the useful parts.

Sources#

• CrowdStrike: VAPOR PANDA uses ARTEX to scale global campaign