Twenty-seven events in 23 seconds. That is what one AI hacking agent logged while probing a victim's AWS permissions, according to a new report from Google Threat Intelligence Group (GTIG) and Mandiant, a rare forensic look at AI agents running real break-ins rather than lab demos.
Since late August 2026, Mandiant incident responders have found multiple threat actors operating open-source, multi-agent pentesting platforms, chiefly ARTEX and PentAGI, along with CAIRN and possibly custom-built harnesses, inside live intrusions. In those cases the agents carried out significant parts of the attack, including lateral movement, database exploitation and preparation for data theft. The report is by Aurora Blum, David Mainor, Rohit Nambiar, Omar ElAhdan, Matthew McWhirt, Will Silverstone, Bhavesh Dhake and Chris Busse, and is available as the original report.
A pentest tool its own author pulled
ARTEX is an autonomous, LLM-driven pentesting and command-and-control platform written in Go, with a web console, that splits the attack lifecycle across six specialized sub-agents. It was released on GitHub by a user called Autumn-27, who took the original repository down in October 2026 because of widespread abuse by threat actors. Forks keep it spreading anyway, including a variant called ScopeWeaver and a commercial ARTEX PRO.
Its users span the motivational spectrum. GTIG tracks one campaign, first reported by Wiz Research, as UNC7228 and says it overlaps with the activity Microsoft attributes to the China-nexus actor STORM-0940. That actor hit enterprise software, industrial automation, semiconductor and telecommunications firms in the US and Europe, typically going from a first compromised account to deep system access in about four hours, and once in 15 minutes. We covered that thread in our earlier report on Wiz's findings, and ARTEX has also surfaced behind VAPOR PANDA's 200-target campaign. Mandiant adds financially motivated data-theft extortion crews and further suspected China-nexus clusters, which hit government, technology, chemicals and materials, and manufacturing organizations in the US.
Fast, persistent, and very noisy
In several cases the attackers simply handed ARTEX stolen credentials for the target and told it to carry on. What followed did not look human. Individual execution runs came in compressed bursts of roughly 2 to 25 seconds. When an exfiltration script failed with a "script too large" error, the agent trimmed it, relaunched it and stood up a 17-snapshot instance in about 10 seconds.
Speed came at the cost of stealth. On an internet-facing Weaver OA server, ARTEX used the application's own SQL API to point MySQL's general query log at a web-accessible .jsp file, then wrote web shell code into it with SELECT statements. Mandiant watched it iterate through numbered shells (cl1217.jsp, f1219a.jsp, z1219.jsp), fixing coding errors until one returned clean output. That single effort produced 240 log events, plus signs of sub-agents overwriting each other.
Elsewhere the agent ran Kerberoasting and DCSync scripts to steal the domain krbtgt key, enumerated more than 110,000 Active Directory objects, and sent command output back over 491 rotating webhook[.]site URLs. In one case it abused an application's notification feature to send test emails to over 1,300 internal users.
PentAGI, a VXControl framework that runs standard Kali Linux tools in sandboxes, was mostly seen scanning, though some operations reached intrusion and persistence. One customized build targeted system integrators and major telecoms in Asia from late August to early October.
The noise is the defender's opening
The artifacts Mandiant recorded give hunters concrete leads: files named artex-probe- followed by five digits, accounts with ArtexProbe in the name, test blobs written and deleted within a few hundred milliseconds, and unexpected outbound traffic to webhook[.]site. For prevention, Mandiant Consulting recommends control-plane isolation, short-lived credentials, least privilege, network segmentation and behavioral detection, and GTIG is candid that these are long-standing best practices rather than new ones.
GTIG assesses that adversary use of these frameworks is still early, with open-source tools used in unsophisticated ways that produce broad, noisy campaigns which nonetheless succeed. Its warning is about the trend line: as the models and their operators improve, Google expects less human involvement and more stealth. The window in which an AI intruder announces itself through sheer clumsiness may be shorter than defenders would like.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.