ARTEX AI: Vapor Panda Ran an Agentic Pentest Framework Against 200 Orgs

For most of 2026 the agentic-attack story was anecdotes: one autonomous agent breaching one lab, a framework spotted on one exposed console. On October 29, CrowdStrike published the version that is not anecdotal — a China-nexus actor it tracks as Vapor Panda running ARTEX, an open-source multi-agent penetration-testing framework, against more than 200 organizations in at least 14 countries over an 11-day window. This is the moment the open-source agentic pentester stopped being a research toy and became a nation-state weapon operating at a scale no human red team can match.

Developing story — first published 22:46 CET (21:46 UTC), November 2, 2026. Updated as CrowdStrike and other vendors publish more.

What happened

CrowdStrike OverWatch found a single ARTEX controller that "intermittently exposed adversary tooling, target files, and ARTEX agent transcripts," letting researchers read the operation from the inside. Beginning October 17, 2026, Vapor Panda pointed it at foreign ministries across Latin America, Europe, Asia and the Middle East; semiconductor, defense, nuclear and think-tank organizations in the U.S.; and telecommunications providers in multiple regions. The numbers, from CrowdStrike:

Framework	ARTEX — open-source multi-agent AI penetration-testing suite
Actor	Vapor Panda (China-nexus), human operator directing the agents
Window	October 17, 2026 onward · 11 days
Reach	200+ distinct organizations · at least 14 countries
Confirmed intrusions	9 orgs — post-exploitation, BLOODALCHEMY backdoor deployed
Also hit	Password-spraying / credential-scanning at 12+ more (U.S. think tanks, European government)
LLM backend	DeepSeek, plus a second unconfirmed commercial model
Scale signal	~1.4 billion input tokens in a single intrusion's planning agents

CrowdStrike's own framing is the part to sit with: "This campaign marks an escalation in China-nexus use of AI agents, from single intrusions to multiple simultaneous engagements directed by a human operator." One person, many machine-speed engagements, running in parallel.

How the agents worked — and what they were told to avoid

ARTEX "coordinates a main agent with subordinate planner and worker agents over a shared graph of facts, findings, and goals, advancing each engagement from initial access through host reconnaissance and lateral movement." The recovered transcripts show the human in the loop literally: an operator issuing instructions in Chinese, tagged 【人类指令】 ("human instruction") and timestamped in China Standard Time, directing the agents to write web shells and extract domain administrator passwords. The agents handled the tedium — recon, exploitation, credential work, re-planning when a path failed — and the operator stepped in at decision points.

The detail that should change how you think about detection: the operation included instructions to identify hosts without the CrowdStrike Falcon sensor and focus follow-on work there. The agents were not told to defeat the EDR. They were told to go around it.

Operator: find the Windows machines in this domain with no endpoint agent. Work there.

That one instruction is the whole defensive lesson. An attacker who routes around the endpoint is telling you where your evidence will not be.

The tool you cannot recall

ARTEX was released open-source by a Chinese developer and only made closed-source after it was tied to real-world attacks — including an earlier campaign against South Korean banks (Shinhan, KB Kookmin, Hana) that ran ARTEX with DeepSeek v4.1-flash and Claude Code sessions. But going closed-source recalls nothing: English- and Korean-language derivatives of the published code remain available, and the Vapor Panda campaign is a different operator from the Korean one. Once an autonomous offensive framework is on GitHub, it is a capability, not a product — forkable, re-hostable, and pointable at anyone. BleepingComputer reports the same tool was behind the September breach of the Dutch non-profit DIVD, where it went from initial access to root in 12 minutes and generated 450,000 requests and 2,500 scripts — "super loud and messy."

Remediation

There is no patch here — ARTEX exploits ordinary weaknesses faster than you can triage them. Harden the things the agents went after:

1. Rotate keys that may already be exposed. CrowdStrike's guidance leads with rotating signing, pre-authentication, and service keys after any suspected exposure — the Greek intrusion reportedly turned on authentication keys from an old mail-server export that were never rotated.
2. Close the cloud-identity shortcuts. Enforce SAML signature validation, require IMDSv2 for instance metadata, and scope cloud roles so a single compromised role cannot run commands fleet-wide.
3. Put EDR on the hosts the attacker hopes you forgot. The agents hunted for machines without the sensor. Internal servers, appliances and build hosts are exactly where that gap lives.
4. Patch internet-facing appliances and apps on the KEV clock, under BOD 26-04 risk-based tiers — these frameworks lead with public-facing exploitation (T1190).
5. Hunt for the tempo, not just the tool. CrowdStrike recommends looking for ARTEX's own operational markers (command-line strings and cloud-role names carrying the tool's artx/artex prefix). But the durable signal is behavioral: machine-rate reconnaissance across many hosts at once, web-shell writes (T1505.003), password spraying (T1110.003), mailbox reads (T1114) and security-software discovery (T1518.001) running at a cadence no human sustains.

What is not known yet

• The second commercial LLM is unconfirmed; CrowdStrike names only DeepSeek with confidence.
• Which specific organizations among the 200+ were breached versus merely reached — CrowdStrike confirmed post-exploitation at nine but does not name all victims.
• Full IOCs and BLOODALCHEMY technical detail are in CrowdStrike's report; verify any list against the source before you block on it.
• Attribution beyond "China-nexus" — aliases and historical overlaps are not settled in the public reporting yet.

Where this leaves defenders

The uncomfortable symmetry is that the attacker's architecture — an autonomous, multi-agent offensive engine directed by one human — is also the only architecture that can test against it at the same tempo. The difference has to be control. Zero Hunt is an autonomous AI red team built to be the governed version of what Vapor Panda ran: a 10-agent swarm that runs recon through pivot on its own private models, on an on-premise appliance, writing a fresh per-target proof-of-concept and backtesting it in the AI Gym before it touches production — so you find the host without the sensor, the un-rotated key, the forgeable SAML assertion before someone else's agent does. Five human-in-the-loop autonomy levels gate every exploitation and escalation step, and every action is approved, recorded and signed at write time: the discipline the attacker's agent does not have, and the reason an offensive AI you run yourself is not the same risk as one you download.

And because Vapor Panda's agents deliberately avoided the endpoint, the surface they could not edit was the network. The same appliance runs a deep-learning traffic model with four inference heads on its own GPU, reading the machine-tempo probing ladder — many paths, many hosts, no human cadence — and the credential-spray and lateral-movement bursts while they happen, not in the next morning's SIEM digest. When the attacker is an agent that re-plans after every response, continuous automated validation on the same loop is the only test that means anything. Talk to us about running that loop against the systems an AI prober reaches first.