China-linked group used ARTEX AI agents against more than 200 organizations
What happened
CrowdStrike reports that an adversary it calls VAPOR PANDA ran the ARTEX agent framework against many targets in parallel from 17 October, mainly using DeepSeek models. At least nine organizations were compromised among more than 200 targeted in more than 14 countries.
BleepingComputer, citing CrowdStrike, says the operation began on 17 October and used ARTEX with DeepSeek plus a second commercial model that CrowdStrike could not identify. A human operator directed several engagements at once. At least nine organizations were compromised, and password spraying and credential scanning targeted at least 12 other high-value targets. What data was taken is not stated in the article.
How it happened
AI-run attack: Autonomous intrusion. The attacker's own AI agent carried out the break-in, working through the steps with little human involvement.
The AI involved was from DeepSeek. The product was ARTEX, a type of AI agent.
Impact
Data was exposed. Data involved: unknown. Many organizations were affected.
Severity is rated High, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It happened or began on 17 Oct 2026. It became public on 2 Nov 2026, 16 days later.
No victim statements are given in the article.