Google: AI hacking tool ARTEX ran 27 attack events in 23 seconds, and the copies keep spreading

Google's Threat Intelligence Group (GTIG) and Mandiant said on October 30 that attackers are now using open-source, AI-driven penetration-testing frameworks in real break-ins. In its report, it says it has seen them in incident response work since late August 2026. The best known is ARTEX, and one logged burst of its activity produced 27 events in 23 seconds while it probed a victim's AWS permissions.

What ARTEX is

Per Google, ARTEX is an autonomous, multi-agent platform written in Go that splits an attack across six specialised sub-agents and uses frontier and open-source model APIs to turn a high-level goal into machine commands. iTnews describes it as a harness rather than a model: it wraps a command shell and a task planner around whichever language model the operator picks.

The developer, a GitHub user called Autumn-27, took the original repository down in October because of abuse, Google says. It did not stop the spread. Copies live on as community forks, including one called ScopeWeaver and a commercial edition, ARTEX PRO. Google also names Hexstrike, CAIRN and PentAGI as frameworks seen in its cases.

The numbers Google logged

• Bursts of ARTEX activity lasted roughly 2 to 25 seconds.
• An 11-resource-type Azure validation sweep took 8 seconds, and a 17-snapshot cloud instance was deployed in about 10 seconds.
• One intrusion into a Weaver OA web server produced 240 log events.
• Command-and-control traffic rotated through 491 webhook.site URLs, and one case enumerated more than 110,000 Active Directory objects.
• The application's own notification system was used to send test emails to more than 1,300 internal users.
• The actor tracked by Wiz as UNC7228 (also listed as Storm-0940) typically moved from a first compromised account to deep access in about four hours, and once in 15 minutes.

The attackers were not using exotic malware. Google's list of techniques reads like a standard audit finding: Kerberoasting, SQL injection, DCSync, abused admin interfaces and over-permissioned cloud credentials. In one case the tool pointed MySQL's general log at a web-accessible path and wrote webshells through it, retrying with new filenames until one worked. Google's own summary is that the tooling "does not fundamentally change the techniques attackers use. It reduces the time required to combine them."

The caveat everyone should read

This is not yet robot hackers running unattended. GTIG researcher Rohit Nambiar is quoted by iTnews saying there is no evidence fully autonomous, human-out-of-the-loop hacking has arrived. Google's seven-stage maturity model puts the current state at stage five, where AI tooling runs several lifecycle phases in the wild. It expects stage six, multi-agent attacks with little human input, in one to three months, and sophisticated fully autonomous attacks in three to six months. Those are Google's projections, not observations.

The tools are also loud. They leave names like artex-probe-* in files and accounts, and generate hundreds of log lines. Google assesses with high confidence that cybercrime groups will keep adopting them anyway, because wider reach makes up for a lower success rate. Stealthy actors are less likely to use the public versions.

Who is using it

Google says users include financially motivated extortion crews and suspected China-nexus espionage clusters, hitting government, technology, chemicals, manufacturing, semiconductor and telecom targets in the US, Europe and Asia. Other reporting fills in some of the detail, and we have not verified these figures ourselves:

• CrowdStrike, as reported by iTnews, says the group it calls VAPOR PANDA used ARTEX against more than 200 organisations in under two weeks, with post-exploitation confirmed at nine.
• The Cloud Security Alliance's research note, summarising other vendors and Seoul police, cites an attack on South Korean financial institutions exposing data on at least 68,000 people, and a police case that alleged more than 90 Korean organisations were breached. CSA also warns the public figures are likely a lower bound because they come from operator mistakes.

What it means for a small business

If your shop, clinic or contractor firm runs a cloud account, a web app with an admin panel and a handful of service logins, you are the kind of target a cheap automated tool reaches. Google's defence list is deliberately unglamorous: keep admin interfaces off the open internet, use phishing-resistant multi-factor sign-in, replace long-lived keys with short-lived credentials, limit what each account can do, and rate-limit anything that sends email or creates users. It also advises alerting on bursts of control-plane activity and on traffic to webhook and file-sharing sites, because a human admin does not make 27 changes in 23 seconds.

The point Google makes is about response time: detecting an attack in time does little if no one can act on it before it finishes. For a company with no night staff, that means pre-agreed automatic actions, such as disabling an account on a bad pattern. Google also published detection rules for webhook.site traffic and suspicious curl use in its Google SecOps rule pack.

Related: G7 finance leaders approve tabletop exercises for AI cyberattacks on banks.

Sources: Google Cloud Threat Intelligence (Oct. 30, 2026); iTnews (Nov. 2, 2026); Cloud Security Alliance AI Safety Initiative (Oct. 28, 2026). Figures from CrowdStrike, Microsoft, Recorded Future and Seoul police are as relayed by iTnews and CSA. This is information, not investment advice.