Cyber attackers are officially using AI agents to hack into enterprises, according to Google’s threat researchers and Mandiant, its cybersecurity incident-response business.
Their report, “ARTEX and Friends: Enter Agentic Offensive Frameworks,” says that attackers had been using such tools in real intrusions since late August. In several cases, hackers gave an AI agent compromised credentials and instructed it to continue the break-in.
They found tools attackers used were originally built for penetration testing, where security professionals look for weaknesses in computer systems with permission.
One of them, ARTEX, can take an instruction, break it into smaller tasks and run commands to complete them. It can also check what happened and try another approach when something fails, rather than waiting for a person to tell it what to do next.
Fast, but far from perfect
Google recorded 27 events in just 23 seconds as ARTEX checked permissions across different security groups in Amazon Web Services (AWS).
ARTEX also made mistakes. In one intrusion, it generated 240 log events while attempting to execute SQL commands through a web server’s exposed application interfaces. Investigators also observed extended pauses between bursts of activity. The findings therefore do not establish continuous, end-to-end autonomous attacks.
CrowdStrike, a cybersecurity software company, documented a separate campaign in which a China-linked group used ARTEX against more than 200 organizations across at least 14 countries. It confirmed activity after compromise at nine organizations. Recovered records showed that human operators were still directing the agents at important points.
When trusted software becomes an entry point
Microsoft investigated another China-linked group using ARTEX. In several attacks, the group gained high-level access to cloud systems less than three hours after initially targeting an organization.
The activity involved compromised application credentials associated with ConnectWise Cloud Backup, formerly SkyKick. ConnectWise, a business software provider, confirmed unauthorized access to those credentials and took protective action. Microsoft found that attackers used the applications’ existing permissions to access customer Microsoft 365 environments without requiring employees to sign in.
In some environments, Microsoft observed attackers modifying application credentials to maintain access and making changes involving identities, groups and privileged roles. Microsoft cautioned that a successful connection did not necessarily mean customer data had been accessed or stolen.
For affected customers, Microsoft recommends checking sign-ins by applications, investigating unexpected changes to their credentials or permissions and preserving activity records.
The attacks still involve human operators and familiar methods, including stolen credentials and abuse of existing cloud permissions. What Google’s findings show is how quickly AI can carry out successive tasks once attackers gain access.