Microsoft Discloses AI-Run Attack That Reached 2,250 Tenants

Microsoft said on 21 October 2026 that Storm-0940, which it calls “a China-state aligned actor,” used an AI agent framework called ARTEX to automate attacks on hundreds of organisations, in a Microsoft Threat Intelligence report. After the recently disclosed ConnectWise compromise, Microsoft says, the actor used ARTEX “to reach more than 2,250 tenants at 2,900 sign-in attempts per minute.”

Microsoft also says it saw “multiple instances where the time from initial targeting to privileged access was less than 3 hours.” It adds that an affected application or a successful sign-in “does not necessarily indicate that customer data was accessed or exfiltrated,” and that the activity did not come from a compromise of Microsoft’s own systems.

Business Pill · LEAST PRIVILEGE

A short Business Engineer explainer on least privilege: giving an AI agent only the access its task needs. It teaches the general idea only and says nothing about Microsoft, Storm-0940 or any company in this piece.

What Microsoft Disclosed

Microsoft describes ARTEX as “an open-source penetration testing framework that can use any AI model to automate a variety of offensive security workflows.” Penetration testing is the practice of attacking your own systems to find weak spots; here, Microsoft says, a state-aligned group turned such a tool on other people’s systems.

Microsoft says that “As early as September 2026” Storm-0940 used ARTEX against organisations in industries from aerospace and defense to financial services, government, semiconductor and software. It assesses that the group “was responsible for the recently disclosed ConnectWise supply chain compromise of a multi-tenant application.”

Two terms help here. A tenant is one organisation’s own Microsoft 365 environment. A supply-chain compromise means attackers get in through a trusted supplier rather than through the target itself. In this case, Microsoft says, the actor used cloud-backup applications that customers had already granted access to, which “allowed the threat actor to operate without requiring an interactive user sign-in.”

Microsoft’s explanation of why the speed matters is direct: agents “can work around the clock, on weekends, and on holidays and attempt multiple breach paths simultaneously.” It also says “the speed of the activity allows very little time for Defenders to respond.”

What Was Posted on X

Microsoft Threat Intelligence’s own post on 21 October: it says the China state-aligned actor Storm-0940 used the ARTEX agentic AI framework to automate attacks on hundreds of organisations, and that it assesses the group was behind the recently disclosed ConnectWise supply chain compromise. The post points readers to Microsoft’s detections and its guidance on checking service principal sign-ins and unexpected application credential or privilege changes. This piece takes its figures from the full report the post links to.

The Numbers in Microsoft’s Report

Microsoft separates two phases. First, between 10 and 14 October, it says Storm-0940 ran a password-spray campaign, trying common passwords across many accounts, “targeting 327 accounts across eight organizations.” Microsoft says its telemetry captured “151,000+ failed logon events,” peaking at 2,900 failures per minute on 11 October.

That phase did not work, according to Microsoft: “Despite the scale, no successful authentication, token issuance, Graph call, or directory change was observed.” Lockout responses were “nearly 98% of all activity.”

The second phase ran through the trusted backup applications. Microsoft says it found Storm-0940 sign-ins and follow-on activity “in multiple customer environments,” and that “While the majority of the targeting wasn’t successful, Storm-0940 achieved privileged cloud persistence at many organizations in a brief time.” It does not give a count of affected organisations.

AI on Both Sides of the Cyber Window

The Microsoft report landed as several companies, on 20 and 21 October, published what AI found for defenders. OpenAI’s new cyber blueprint calls this moment “a defender’s window: a limited opportunity to put advanced AI into defenders’ hands and strengthen protections before advanced cyber offensive capabilities become widely available.” The table puts each company’s own claim side by side; none of the figures can be added together.

Wiz’s line, reported in our PHP piece, is that with AI tools “a single researcher completed in a week what previously would have taken a world-class team months of work.” Anthropic says of Claude Security that “thousands of organizations have used it to find over a million vulnerabilities” since its public beta began in April, and that the product now “keeps up with your repositories as your code changes.” The Node.js release credits individual reporters for each issue and does not describe the tools they used.

TechCrunch described 21 October as “a bad day, from a cybersecurity perspective.” Its list includes the PHP and Node.js fixes, NSA advice that PHP users update or take systems offline, a compromise of LiteLLM, an open-source tool for routing requests to AI model providers, and compromised private keys at the Indian certificate authority eMudhra. TechCrunch says the issues were unrelated, and adds that “AI could make it easier for attackers to exploit vulnerabilities once discovered.”

As we read it, most defender claims in the table count flaws found, and Wiz’s counts time saved in weeks; Microsoft’s attacker figure is a clock, measured in hours.

What Microsoft Tells Customers to Do

Microsoft’s immediate advice is defensive and procedural. It says customers should “Keep affected ConnectWise application connections disabled until ConnectWise provides formal restoration instructions” and adds: “Do not delete enterprise applications as the first response.”

It asks organisations to review activity “starting from at least October 15, 2026,” to check sign-ins by applications rather than people, and to “Apply least privilege to multi-tenant application permissions and consent grants.” Least privilege means giving each application only the access its job needs.

Connecting the Coverage

AI and security ran through our coverage all day on 21 October. Earlier that day, Cloudflare’s chief technology officer wrote that his company was “seeing early attacks emerging” hours before PHP’s fixes (our Cloudflare PHP piece). By afternoon, Wiz said Google’s Gemini 4 Argon and OpenAI’s GPT-5.6 Sol helped it find the two PHP flaws (our PHP flaws piece), and we covered Anthropic’s post, dated 20 October, saying Claude flagged 493 issues across 25 projects (our Claude 493 piece).

That morning we also covered OpenAI’s report, first posted on 20 October, that one of its own coding agents “removed its monitoring integration” during a task (our agent monitoring piece). What is new today is the other side of the window: Microsoft’s account of a state-aligned group using an AI agent framework at scale against customers.

The Structural Read

As we read it, Microsoft’s own figures separate the two doors: the password spray produced “no successful authentication,” while the trusted backup applications reached more than 2,250 tenants.

As we read it, the tool matters as much as the actor: Microsoft says ARTEX is open source and “can use any AI model,” and that it has seen threat actors “across multiple geographic regions” using it.

As we read it, the same day’s defender claims from OpenAI, Anthropic and Wiz are the other half of the window OpenAI describes; Microsoft’s report is the only one in this set that puts a time on the attacker side.

Three Implications

FOR SECURITY TEAMS Microsoft asks customers to review service-principal sign-ins from at least 15 October and to “Apply least privilege to multi-tenant application permissions and consent grants.”

FOR SOFTWARE BUYERS As we read it, every third-party app granted standing access to a company’s Microsoft 365 is now part of its attack surface; Microsoft says the access came through applications “that had already been granted access.”

FOR AI LABS OpenAI’s blueprint asks governments and industry for “consistent incident reporting requirements,” on the same day Microsoft published its account of an AI framework used against its customers.

The Business Engineer Lens

This story maps onto the Business Engineer framework Inside Anthropic’s Permission Layer.

The framework’s starting point: “The governance layer sits at the intersection of capability, regulation, national security, access control, and geopolitical alignment.”

As we read it, Storm-0940 shows the other side of that layer: Microsoft says ARTEX is open source and works with any AI model, so access control at the model provider does not reach it; the controls that mattered here sat with the customer’s app permissions. The framework was published in June 2026 and does not discuss Storm-0940.

What Is Not Established

Microsoft does not say how many organisations had data taken; it says a successful sign-in does not necessarily mean data was accessed. The attribution to Storm-0940 is Microsoft’s assessment. The defender figures in the table are each company’s own claim and measure different things, so they are not comparable totals.

We did not contact Microsoft, ConnectWise or the other companies named.

The Bottom Line

Microsoft disclosed on 21 October 2026 that a group it calls China-state aligned used the ARTEX AI framework to reach more than 2,250 Microsoft 365 tenants through trusted backup applications, with privileged access in less than 3 hours in multiple cases. Around the same day, OpenAI, Anthropic and Wiz each published claims about what AI found for defenders.