On 21 October 2026 Microsoft published the primary report behind the ARTEX activity covered yesterday. It says Storm-0940 used ARTEX from September 2026 and, after taking control of ConnectWise application identities (reported 15 October), authenticated into more than 2,250 customer tenants using consent those apps already held. In some tenants the agents then used Microsoft Graph to change app credentials, groups and privileged roles, and read secrets in bulk from Azure Key Vaults. In several cases the interval from first targeting to privileged cloud access was under three hours. Microsoft's own counts show the separate 10–14 October password spray failed. The successful path was the vendor app, not user passwords.

The exposure is the identity provider's set of third-party multi-tenant applications and the permissions they were granted at onboarding. An agent holding a vendor's app credential needs no phishing and no MFA bypass, and a three-hour run to privilege finishes before most weekly access reviews or vendor-notification processes start. Microsoft asks responders to search by application ID back to 1 October, because display names can be changed.

On 21 October 2026 CrowdStrike described four previously unreported actors, observed between May and August 2026, each of which left its agent framework in an open directory. A Spanish- and English-speaking operator ran a supervisor agent that picked tasks from an attack-stage state machine and an executor that carried them out, built on PentestGPT with added MCP servers. A Chinese-speaking operator reached models through a China-based proxy and ran parallel specialist agents against government and private targets. An Indonesian-speaking operator used 819 skills, mostly from public repositories, with no orchestration of its own, and had to intervene to get past model guardrails. A Russian-speaking group started a seven-step workflow from a single slash command and took client data from a US CRM vendor.

The targets were internet-facing applications and SaaS platforms in healthcare, government, CRM and data-centre providers, which are the same suppliers that hold enterprise customer data. The tooling is public, and a low-skill operator got useful results by loading published skills into a coding agent. That makes this volume, not a single actor, that perimeter detection and supplier assurance need to plan for.

On 21 October 2026 Symantec's Threat Hunter Team published the instruction set of an offensive agent captured this summer by a honeypot posing as an unprotected model service. The operator sent the agent's prompt to what it took for a free model. The prompt framed reading `.env` files, API keys and database schemas as routine development work, told the model to run tools without asking, and allowed up to 100,000 steps. A second request a day later, from a rotated address, asked the model to decode a script that compiles a Monero miner aimed at camera gateways. Over the monitoring period the honeypot logged more than 127,000 requests, mostly endpoint reconnaissance, stolen-key attempts and probes for configuration files.

The component is any OpenAI-compatible endpoint an enterprise exposes, including self-hosted inference servers, internal AI gateways and test deployments. They share one interface, so a single scanner finds them all. An exposed endpoint is no longer just a billing risk. It becomes the planning engine for attacks on third parties, run on the enterprise's compute and traced back to its addresses.