Hackers Are Now Using AI Agents in Real Cyberattacks

The cybersecurity industry's warnings about autonomous AI are starting to look less theoretical. Microsoft says a Chinese state-aligned hacking group used an AI-driven penetration-testing framework during a campaign that targeted hundreds of organizations around the world.

The framework, called ARTEX, can automate tasks such as reconnaissance and data exfiltration. Like many security tools, it has legitimate uses, but it can also be configured for autonomous offensive activity.

Why this campaign stands out

The targets spanned aerospace, defense, energy, finance, government, manufacturing, semiconductors, technology and other sectors. Microsoft said most of the attempted compromises failed, but the attackers still established high-level cloud persistence at a number of organizations.

That means AI was not merely helping someone write phishing emails. It was being used inside a broader intrusion workflow.

Offense can scale faster than defense

Automation has always mattered in cybersecurity, but agentic AI can make it easier to chain tasks together. A system that can scan, test, adapt and continue operating without constant human input changes the economics of an attack.

Defenders can use the same technology, but they also have to prepare for adversaries that can probe systems continuously and at machine speed.

A new phase for cybersecurity

The important question is not whether AI will be used in cyberattacks. That is already happening. The question is how autonomous those systems become and how quickly defensive tools can keep up.

Organizations may need to rethink identity, cloud permissions and monitoring around the assumption that future attackers will be partially automated by default.