{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/findings/attackers-use-open-source-agent-frameworks/",
 "asOf": "2026-10-30",
 "id": "attackers-use-open-source-agent-frameworks",
 "claim": "Attackers have run real intrusions with publicly available, open-source agent frameworks such as ARTEX, PentAGI and Hermes Agent, not only with commercial AI products.",
 "evidenceKind": "observed",
 "scope": "Reports from a government CERT and security vendors, from September and October 2026, mostly built from attacker infrastructure or the reporter’s own telemetry. Some identify frameworks while other campaigns leave tooling unnamed, and reporters often infer model identity and autonomy. They do not establish prevalence or fully autonomous operations. Microsoft does not describe its ARTEX-identification method in the Storm-0940 report. Several frameworks were built for authorized penetration testing.",
 "topics": [
  "ai-enabled-intrusion",
  "autonomous-pentest",
  "threat-intelligence"
 ],
 "atlas": [],
 "evidence": [
  {
   "event": "threatdown-carbonato-agent-botnet-2026",
   "note": "A botnet installs the open-source Hermes Agent framework on compromised Docker hosts and has it carry out operators’ tasks."
  },
  {
   "event": "crowdstrike-artex-south-korean-finance-2026",
   "note": "CrowdStrike reports that an unattributed actor, assessed with moderate confidence as financially motivated, used ARTEX alongside Claude Code against South Korean financial firms; its evidence is the actor’s exposed session histories and configuration files."
  },
  {
   "event": "cert-in-ciad-2026-0049-ai-agents-attack-vectors-2026",
   "note": "CERT-In reports a financially motivated campaign against Indian entities that abused publicly available, rebranded agentic offensive-security frameworks, without naming them."
  },
  {
   "event": "microsoft-storm-0940-artex-connectwise-2026",
   "note": "Microsoft reports a China-state aligned actor using ARTEX to automate attacks on hundreds of organizations, including sign-in attempts against more than 2,250 tenants after the ConnectWise compromise."
  },
  {
   "event": "straiker-carliy0s-cybercartel-latam-banks-2026",
   "note": "Straiker reports a criminal group built a multi-agent system on the open-source PentAGI framework and used it against more than 400 Latin American financial targets; a single vendor’s investigation."
  },
  {
   "event": "crowdstrike-vapor-panda-artex-global-campaign-2026",
   "note": "CrowdStrike separates the VAPOR PANDA campaign from Storm-0940 and reports human-directed parallel ARTEX intrusions, distinguishing targets from confirmed post-exploitation activity."
  },
  {
   "event": "microsoft-north-korean-artex-adoption-2026",
   "note": "Microsoft reports Onyx Sleet and Pearl Sleet using ARTEX in human-directed operations from late October 2026. This supports framework adoption; the report does not document a specific successful ARTEX intrusion by either actor."
  }
 ],
 "relations": [
  {
   "type": "supports",
   "target": "attackers-run-intrusions-through-agents",
   "note": "Shows that the agent-driven intrusions include operations built on freely available frameworks rather than only on providers’ own products."
  }
 ],
 "statusHistory": [
  {
   "status": "corroborated",
   "on": "2026-10-22",
   "why": "A government CERT and four security vendors independently report attacks run with open-source agent frameworks: ThreatDown (Hermes Agent), CrowdStrike and Microsoft (ARTEX), CERT-In (unnamed frameworks) and Straiker (PentAGI).",
   "event": "microsoft-storm-0940-artex-connectwise-2026",
   "kind": "evidence"
  }
 ],
 "halfLifeDays": 365,
 "wouldChange": "Evidence that activity attributed to these frameworks was driven by people or conventional scripts, or incident data showing such use is rare compared with commercial AI products.",
 "fideQuestions": [],
 "methods": [
  "agent-orchestrated-intrusion"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-10-22"
}