Reports from a government CERT and security vendors, from September and October 2026, mostly built from attacker infrastructure or the reporter’s own telemetry. Some identify frameworks while other campaigns leave tooling unnamed, and reporters often infer model identity and autonomy. They do not establish prevalence or fully autonomous operations. Microsoft does not describe its ARTEX-identification method in the Storm-0940 report. Several frameworks were built for authorized penetration testing.
Corroborated: Supported by at least two independent sources.
Evidence
A botnet installs the open-source Hermes Agent framework on compromised Docker hosts and has it carry out operators’ tasks.
CrowdStrike reports that an unattributed actor, assessed with moderate confidence as financially motivated, used ARTEX alongside Claude Code against South Korean financial firms; its evidence is the actor’s exposed session histories and configuration files.
CERT-In reports a financially motivated campaign against Indian entities that abused publicly available, rebranded agentic offensive-security frameworks, without naming them.
Microsoft reports a China-state aligned actor using ARTEX to automate attacks on hundreds of organizations, including sign-in attempts against more than 2,250 tenants after the ConnectWise compromise.
Straiker reports a criminal group built a multi-agent system on the open-source PentAGI framework and used it against more than 400 Latin American financial targets; a single vendor’s investigation.
CrowdStrike separates the VAPOR PANDA campaign from Storm-0940 and reports human-directed parallel ARTEX intrusions, distinguishing targets from confirmed post-exploitation activity.
Microsoft reports Onyx Sleet and Pearl Sleet using ARTEX in human-directed operations from late October 2026. This supports framework adoption; the report does not document a specific successful ARTEX intrusion by either actor.
How it relates to other findings
Select a finding to see how it relates to others. Arrows point from the newer finding to the one it supports, qualifies, contests, or supersedes.
- This finding supports Attackers have used AI agents to carry out much of the work of real intrusions, from reconnaissance to credential theft and extortion, with people directing them at a few decision points.Shows that the agent-driven intrusions include operations built on freely available frameworks rather than only on providers’ own products.
Key questions that rely on this finding
- How are attackers using AI agents in real operations?To run parts of intrusions at scale: vendors report a state-aligned actor and criminal groups using open-source agent frameworks and commercial models.
Status history
- 2026-10-22CorroboratedA government CERT and four security vendors independently report attacks run with open-source agent frameworks: ThreatDown (Hermes Agent), CrowdStrike and Microsoft (ARTEX), CERT-In (unnamed frameworks) and Straiker (PentAGI). · record