- Wiz says an actor used tooling tied to the ARTEX AI agent against IT and software vendors' identity systems throughout October 2026.
- Wiz reports that the agent chained steps, adapted to blocks within minutes and ran sessions of 24 to 30 hours. Most attempts failed.
- Defenses that rely on wearing an attacker down need a second look. Check password-spray alerts, source maps and tenant isolation.
Much of login security rests on a quiet assumption. Attackers tire, make mistakes and move on to easier targets. A report from Wiz describes an actor whose tooling kept going. The lesson here is that automation lowers the cost of persistence. Any defense built to wear an attacker down deserves a second look.
What Wiz observed
Wiz reports activity through October 2026 from one actor. The actor used tools linked to ARTEX, an AI agent that runs penetration tests on its own. The targets were several IT and software vendors. The focus was identity providers, meaning the services that handle sign-in: Okta, Entra and Cognito. Wiz also describes abuse of Microsoft 365 integrations.
Wiz saw repeated attempts to find ways around sign-in, to list the vendors' APIs and to access the vendors' customer data. Wiz says most of these attempts failed. The report does not describe a confirmed breach of customer data.
Wiz says this overlaps with Microsoft's report on Storm-0940. Wiz describes that group as aligned with the Chinese state. The incident it links to involved credentials taken from vendors and Microsoft 365 tenants further down the chain.
Wiz also saw the same infrastructure and habits aimed at the wider sector. It says the same actor is trying to reach other software sectors.
How the tool works
ARTEX is an open-source framework. A developer in China put it on GitHub in July 2026. In September it won a red team contest run by Baidu, called "Agent+". A red team plays the attacker to test a company's defenses.
The design is simple. A person gives the tool a target and a goal. A planner agent chooses each next move. Worker agents then run standard tools such as nmap, curl and Impacket. Everything they learn goes into a common record of assets and findings, which guides the next move.
Wiz says attackers adopted it within weeks. It found ARTEX traces in late-September incidents at South Korean banks and October incidents at Japanese firms. Microsoft and Zscaler have linked it to two separate actors. The developer closed the source on October 8. The project had been forked more than 12,000 times by then, so copies are still out there.
Each step feeds the next
Wiz says the agent first read the application itself. It pulled down JavaScript files, source maps and API documentation. A source map translates shipped code back into readable form. Minutes later, the agent was calling internal API routes by name. Those names appear only in the source maps it had just fetched.
Next it tested sign-in. Wiz saw a forged login token with its signature check switched off. Within two minutes, the agent sent that token to more than 60 variants of single sign-on addresses.
It also went after account recovery. It checked which usernames existed, then repeatedly called the password-reset endpoints.
On sites that allowed sign-up, it used a throwaway address from a free temporary-email service. It confirmed the account and straight away asked for another company's data.
Wiz also tracked a large password-spray campaign. Spraying means trying the same guesses across many accounts. It hit hundreds of users in coordinated bursts, mostly software engineers. Each burst lasted 20 to 60 minutes. The median gap between attempts was one second. Each burst used its own user-agent string, the label a browser or tool sends to identify itself. Some sessions ran 24 to 30 hours.
Fatigue was a control
This is the idea to hold onto. Rate limits and IP blocks work partly because they raise the attacker's cost. A human has to wait, switch tools and try again. Sooner or later, a human stops.
Wiz says the agent adapted when a login page began limiting requests. It moved to another endpoint on the same host and carried on. Blocking an address bought little time. Wiz saw replacements within minutes.
This shows how those controls were designed. They were built to slow a person, and the tool Wiz describes treated them as an obstacle to route around.
Wiz adds that none of the techniques is new. What changed is that the steps were chained automatically and run at a steady pace. A night watchman's rounds assume a burglar cannot test every door at once. An agent that tries each door in turn does not fit that assumption.
The people involved are specific. Engineers were the main target of the spraying. Staff who run login and recovery pages must tune the response. Customers have data behind the tenant boundaries that the agent tested.
What the evidence does not show
Wiz states that most of these attempts failed. Its tie to Storm-0940 is an overlap with Microsoft's report, not a confirmed identity.
Wiz infers the use of an AI agent from the tooling it links to ARTEX and from behaviour such as timing, chaining and adaptation. The report presents this as its assessment, not as a confession or a recovered system.
Wiz also notes that many of the user agents it lists are shared with other actors. Hunting on them alone will pull in unrelated traffic. Wiz sells related products, including an AI Red Agent. Read its framing with that in mind.
Questions for your security team
Wiz says existing detection rules can catch this activity. Its examples include many failed logins across users followed by an admin success, and unusual bursts of access-denied events. Ask whether you run equivalents. Ask whether they alert per account, not only per IP address.
Ask whether production builds expose source maps or API documentation. Ask whether a self-registered account can reach another tenant's data. Ask how password-reset and recovery endpoints are rate-limited and monitored. Ask what extra protection engineers' accounts carry, since Wiz says they were the main spray target.
Defenses that count on the attacker giving up need to hold up without that assumption.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: Wiz.
