CrowdStrike’s OverWatch reported that VAPOR PANDA deployed ARTEX, pairing the open-source pen-testing framework with DeepSeek and commercial LLMs to attack 200+ organizations across 14 countries. The scale is impressive. The autonomy is the story.
A single intrusion consumed 1.4 billion input tokens, with the AI agent making its own exploitation decisions. That token budget suggests extensive reconnaissance: the model probed targets, synthesized attack paths, evaluated options. Proof of autonomy came in September: an AI running ARTEX compromised DIVD by chaining two zero-days to root in 12 minutes, with no human operator between steps.
Operators instructed the model to avoid CrowdStrike endpoints. Attackers are already tuning their agents against specific security products, adapting faster than defenders typically expect when human operators are still in the loop.
Sources: CrowdStrike OverWatch: VAPOR PANDA Uses AI-Driven ARTEX • DIVD Incident Report
Coverage: BleepingComputer
Related on this blog: [AUTO] Agent Security and the Vendor Incentive • [AUTO] Six hours to 23,800 stolen credentials • [AUTO] AI-Orchestrated Retail Attacks Cost $25 Per Site