grep -rl "artex" ./articles
CrowdStrike published its ARTEX numbers on 29 October. The headline figure is more than 200 organisations in at least 14 countries. The confirmed post-exploitation figure is nine, and the operator's instruction is the line to keep.
Google published its ARTEX analysis on 31 October. The useful part is not that AI agents are running intrusions, it is the telemetry: 27 events in 23 seconds, 110,000 directory objects, and 491 rotating callback URLs.
The attribution is out: Microsoft assesses the ConnectWise compromise was China-state aligned Storm-0940, using an agentic pentest framework. The spray campaign is the visible half, and it failed entirely.
CrowdStrike traced a data-theft campaign against South Korean financial firms to an operator driving ARTEX, an open-source agentic pentesting tool, across several large language models. The research exists because the attacker left their own working directories readable.