Microsoft says a China-linked group pointed an autonomous multi-agent system called ARTEX at more than 2,250 corporate cloud tenants, breaking into some in under three hours. The disclosure is the clearest evidence yet that an agentic AI attack can run a full intrusion at a speed no human defender can match. The era of machine-versus-machine cyber conflict has arrived, and most companies are not ready.

By Blumefield | October 25, 2026

When the Machines Logged In

For years, the phrase agentic AI attack lived mostly in red-team slide decks and research papers, a hypothetical that sounded alarming but rarely left the lab. That changed this week. Microsoft's threat intelligence team published a detailed account of a China state-aligned group it tracks as Storm-0940 using an autonomous, multi-agent system to run a live intrusion campaign against corporate cloud environments. According to the company's figures, the operation attempted sign-ins against more than 2,250 Microsoft 365 tenants, generated over 151,000 failed logins, and in several cases reached privileged cloud infrastructure in under three hours.

The numbers tell a story about tempo as much as scale. At its peak on October 11, the campaign fired roughly 2,900 sign-in attempts per minute. In one burst, the system logged more than 200 successful sign-ins in under four minutes using just four stolen application credentials. These are not the rhythms of a human operator hunched over a keyboard. They are the cadence of software that never tires, never sleeps, and never needs a weekend.

What makes this agentic AI attack different from the familiar grind of password spraying is not any single clever exploit. It is the orchestration. A swarm of language-model-driven agents handled reconnaissance, credential abuse, lateral movement, and persistence as one coordinated workflow, with little human steering. The result reads less like a break-in and more like an automated audit run by someone who wanted to own the building.

What ARTEX Actually Does

The tool at the center of the story is called ARTEX, an open-source penetration testing framework built as a multi-agent system in Go with a web front end. On paper it is a legitimate security product, the kind of thing defenders use to probe their own networks. In practice, Microsoft says, it can be pointed at any target and configured to run a full penetration test autonomously, from first scan through data exfiltration, while its agents accumulate every discovered asset and weakness into a shared graph.

That design is the quiet revolution here. Traditional attack tooling automates individual steps. ARTEX automates the judgment between steps, the part that used to require a skilled operator deciding what to try next. Because it can run on top of any large language model, the framework inherits whatever reasoning ability the underlying model provides, and it improves as those models improve. That is what turns a legitimate research tool into the backbone of an agentic AI attack. Microsoft noted that the same framework has already surfaced in reporting on data breaches at Korean financial institutions, and that threat actors in several regions are now experimenting with it.

Microsoft was blunt about the asymmetry this creates. Its analysts wrote that automated agents "can work around the clock, on weekends, and on holidays," and that "agents are not constrained by factors affecting humans." A defender's shift ends. The attacker's does not.

A Supply Chain Turned Into a Skeleton Key

The most consequential part of the campaign was not the brute-force noise but the quiet leverage behind it. Storm-0940 gained unauthorized access to ConnectWise Cloud Backup, a widely used IT management service, and from there compromised several of ConnectWise's own trusted cloud application identities. Those identities are multi-tenant, meaning they are designed to reach into many customer environments at once. Armed with them, the attackers could authenticate directly into customer Microsoft 365 tenants without ever triggering an interactive user login.

In at least one case, a compromised management application assigned itself the Global Administrator role, the highest level of control in a Microsoft cloud tenant. From that position the agents enumerated secrets stored in Azure Key Vaults, read them in bulk, added new credentials to existing applications, and altered privileged roles. Microsoft warned that these added credentials can keep access alive even after the original application is disabled, which is why it urged victims not to simply delete the affected apps as a first response.

This is the supply chain attack pattern that has haunted security teams since SolarWinds, now fused with autonomous tooling. One trusted vendor relationship becomes a skeleton key, and an agentic AI attack turns that key fast enough to be through the door before anyone reads the alert. ConnectWise suspended the affected service and began a phased restoration, but cautioned that containment does not undo access that may already exist inside individual customer tenants.

Why Machine Speed Changes Everything

Security has always been a contest of time. Defenders assume a window between the first probe and the moment real damage is done, time enough to spot the anomaly, escalate, and respond. Agentic tooling collapses that window. An agentic AI attack compresses the whole kill chain into a single uninterrupted sprint. When an operation can move from initial targeting to Global Administrator in under three hours, the human response loop, the pages and bridge calls and approval chains, becomes the slowest and weakest link.

There is a second, subtler shift. Because these systems generate enormous volumes of traffic and logs, they do not just move faster than defenders. They bury the signal. A security team staring at 151,000 failed logins and thousands of touched tenants faces a triage problem that no amount of overtime solves. The agentic AI attack wins not only on speed but on sheer informational overload, forcing defenders to automate their own response or drown in alerts.

For boards and executives, the uncomfortable implication is that security budgets built around human analysts are already a half-step behind. The logical answer, defensive agents that patrol and respond at the same machine speed, raises its own questions about trust, oversight, and what happens when autonomous systems on both sides engage each other with no human in the loop.

The Defenders' Dilemma

Microsoft's remediation guidance is detailed and sobering. It tells victims to preserve evidence before touching anything, to inventory every affected application identity by its underlying ID rather than its display name, to comb through weeks of sign-in and audit logs, and to rotate credentials only after the forensic picture is clear. The sheer length of that checklist is itself a signal of how deep a single compromised vendor credential can reach into a modern cloud estate.

The broader lesson lands harder. The barrier to running a sophisticated, autonomous intrusion is falling, and it is falling for nation-states and criminals alike. Every successful agentic AI attack lowers the bar for the next one. Blumefield reported last week how a lone operator used a similar multi-agent framework to breach more than 100 websites for roughly fifty dollars each, a story about economics. This one is about power, and about a state actor proving that the same tools scale to strategic ambition. Readers tracking this shift can follow our continuing coverage at Blumefield.

None of this means defenders are helpless. The same model advances that make ARTEX dangerous also sharpen the detection and response tools security vendors are racing to ship. But the Storm-0940 campaign draws a clear line on the calendar. The question is no longer whether an agentic AI attack can breach a hardened enterprise at machine speed. Microsoft just documented one that did. The question now is how fast the rest of the world decides to answer.