Attackers used a free AI tool to break into company clouds in under 3 hours

The short version

• Artex is a free AI tool that can run a cyberattack from start to finish with little human help.
• Microsoft says one state-backed group used it to gain top-level access to company cloud systems in under 3 hours.
• An internet-scanning research firm found 1,465 computers running its control screen openly online on 4 November.

What Artex is

Artex appeared on GitHub, a public code-sharing site, in July 2026. Its developer described it as a tool for testing your own systems for weak spots.

You give it a goal, such as getting into a website's admin panel. A planning AI breaks the goal into steps. Worker AIs then scan the target and try ways in, reporting back as they go. The cycle repeats until the goal is met. It can run on AI models from Anthropic or OpenAI, among others.

Attackers found it useful quickly. In October, two separate reports linked Artex to real attacks. One wave hit financial firms in South Korea. The other went through a cloud backup service run by ConnectWise, an IT software company, to reach its customers.

How fast the attacks moved

Microsoft tracked a group it calls Storm-0940, which it describes as aligned with the Chinese state. The group used Artex to automate scanning and password guessing at hundreds of organizations. Targets ranged from banks and carmakers to governments and media firms.

The speed is what stands out. In several cases, the time from choosing a target to gaining top-level cloud access was under 3 hours.

After the ConnectWise break-in, the group tried to sign in to more than 2,250 company cloud accounts. In one earlier campaign, failed logins peaked at 2,900 a minute.

Microsoft points out that AI agents don't get tired. They keep working through nights and holidays, and they try many routes at once. Alerts may go off, but defenders have very little time to respond.

The methods themselves were familiar. Storm-0940 usually gets in by trying common passwords across many accounts. It then hijacks outside apps that already have access to a company's cloud, so it needs no staff login.

Hundreds of copies left open online

The research firm counted 1,465 computers with an exposed Artex control screen on 4 November. About 650 of them share identical setups, which leaves roughly 815 distinct ones. The screen never needs to be reachable from the internet, so the true number in use is likely higher.

Not every copy belongs to a criminal. Some are run by authorized testers. But 32 of these servers also had open folders that anyone could browse. They held break-in kits and hidden programs that attackers plant to keep access.

Asia shows up heavily. After the US, most copies sat in Hong Kong and China, and 38 were in Singapore. The developer has since said Artex will no longer be released publicly. Earlier copies are still in use.

What it means for companies in Indonesia

Artex lets attackers try many targets at once, at machine speed. Indonesian banks and online platforms are the same kind of target as the Korean financial firms hit in September.

Storm-0940's usual way in is password guessing, which a second login step makes much harder. Reviewing which outside apps can reach your cloud data closes the other route it used.

What to do next

• Turn on a second login step for every cloud account, starting with administrators.
• Block common and reused passwords, and watch for bursts of failed logins.
• List every outside app with access to your email and files, and remove the ones you don't need.
• Make sure someone can act on a serious security alert within minutes, at any hour.
• Ask your security team or partner whether they test your defenses against AI-driven attacks.