CrowdStrike links AI agents to attacks on more than 200 organizations

CrowdStrike researchers say a Chinese threat actor used the ARTEX AI penetration-testing framework against more than 200 organizations across 14 countries, compromising at least nine. The campaign began October 17 and targeted government, telecommunications, pharmaceutical, semiconductor, defense, nuclear and financial organizations. The actor, tracked as Vapor Panda, used DeepSeek and another commercial language model to coordinate planning and worker agents across simultaneous intrusions. Agents conducted reconnaissance, exploited vulnerabilities, deployed web shells and obtained credentials. Human operators intervened at critical decisions and instructed agents to avoid Windows machines protected by CrowdStrike's Falcon software.