Understand this story
Microsoft security researchers say that hackers linked to the Chinese government breached ConnectWise's cloud backup service and stole application credentials used to establish data links, allowing them to log in as authorized users to customers' Microsoft-hosted environments and access email and other files. The hackers used AI agents to break into about 2,250 organizations at a rate of nearly 3,000 login attempts per minute, a pace Microsoft says left defenders with almost no time to detect and respond. The AI framework used was the open-source stress-testing framework ARTEX. ConnectWise said it has suspended access to the cloud backup system and launched an investigation, and as of Thursday it was restoring service.
AI-generated from public reports
Developments
1 confirmed developments
Reports and discussion timeline
Browse reports and discussion by time. Their evidence levels remain distinct.
Oct 24
gihyo.jp
AI accelerates cyberattacks; Anthropic, OpenAI, Microsoft and others disclose defense and agent control developments
gihyo.jp reviews multiple releases and reports from late October, organizing AI-era defense challenges along two lines: vulnerability remediation implementation and permission management. Anthropic Deputy CISO Jason D. Clinton says that within about 18 months, high cyber capability will spread to small, cheap models, but fixes still need to be applied to running systems. The article cites OpenAI's discovery of Brotli's CVE-2026-111497 during testing in an isolated environment, and introduces remediation and credential control solutions such as AWS Continuum, Google Agent Compute Engine, and 1Password for Agents, as well as Microsoft's report on Storm-0940 using AI to automate attacks.
Exponential View
Azeem Azhar: AI is turning old vulnerabilities into serious problems, and the internet will become safer but more closed
Azeem Azhar believes the current internet is under intense attack, with AI greatly increasing the scale and speed of exploiting old vulnerabilities; PHP2Shell, Node.js vulnerabilities, and the AI agent cluster intrusion disclosed by Microsoft are contemporaneous cases. He cites Cloudflare head Matthew Prince's prediction that within five years the number of AI agents will reach 1,000 times the number of human users, and judges that attacks will worsen first, with the internet ultimately left safer but less open. The article also mentions that Anthropic once delayed the release of Claude Mythos, while the open-source model GLM 5.3 had by August approached its level.
Oct 23
Latent Space
Latent Space summary: Black October security incident wave
Latent Space compiles the vulnerabilities and intrusion incidents that emerged in a concentrated burst over roughly 48 hours from October 21 to 22 into Black October, covering the PHP2Shell unauthenticated RCE, a CVSS 10 vulnerability present in GitLab versions since 2014 (fixed in 19.5.1), LiteLLM 1.107.0 carrying a password stealer, and the eMudhra CA having weak keys and exiting the CA business. The article also mentions that Microsoft attributed the ConnectWise supply chain attack to Storm-0940, which used the open-source agent penetration testing framework ARTEX to launch roughly 2,900 login attempts per minute against more than 2,250 Microsoft 365 tenants. The author also includes the opposing view, which holds that this looks more like a defensive audit and that there is currently no evidence of large-scale exploitation.
TechCrunch AISelected
Microsoft says China-linked hackers used ConnectWise vulnerability to spy on thousands of enterprises
Microsoft security researchers say hackers linked to the Chinese government breached ConnectWise's cloud backup service and stole application credentials used to establish data links, allowing them to log in as authorized users to customers' Microsoft hosted environments and access email and other files. The hackers used AI agents to compromise about 2,250 organizations at a rate of nearly 3,000 login attempts per minute, a speed Microsoft says left defenders almost no time to detect and respond. The AI framework used was the open-source stress-testing framework ARTEX, which was previously used in an intrusion into South Korea's financial system. ConnectWise said it has suspended access to the cloud backup system and launched an investigation, and as of Thursday was restoring service.