Attackers are now using teams of AI agents to break into many organisations at once. On 29 October, CrowdStrike reported that a China-linked group it calls VAPOR PANDA used an AI attack framework called ARTEX, running mainly on DeepSeek, against more than 200 organisations in at least 14 countries over 11 days, starting 17 October. CrowdStrike confirmed the attackers got inside nine of them. The targets were mostly governments and large companies, but the doors the agents walked through are the same ones most small businesses leave open: old keys never changed, guessable passwords and secrets sitting in email. AI makes those mistakes cheaper to find, at scale.
When I set up AI for a client, the first hour is rarely about AI. It's about passwords. Who has the login to the website, which shared account three ex-employees still know, where the Wi-Fi and bank details are written down. Usually the answer is "in an email somewhere".
This week, a security report showed why that hour matters more than ever. Attackers handed the boring work of trying every door to AI agents, and the agents kept trying, in parallel, across hundreds of targets.
What happened in the VAPOR PANDA AI cyberattack?
In a report published on 29 October, CrowdStrike describes the first time it has seen this group use AI-driven intrusion tools. In its words: "This campaign marks an escalation in China-nexus use of AI agents."
| What | The detail | In plain English |
|---|---|---|
| Who | VAPOR PANDA, a China-nexus group that has targeted governments, think tanks, energy and extractive companies since 2021 | An experienced espionage group, not amateurs |
| The tool | ARTEX, an agentic intrusion framework: a main agent coordinates planner and worker agents that share a map of facts, findings and goals | A manager AI hands out jobs to helper AIs and keeps notes on what worked |
| The AI models | Mainly DeepSeek, plus a second commercial subscription model CrowdStrike couldn't identify | Off-the-shelf models, not a secret super-AI |
| Scale | More than 200 organisations, at least 14 countries, an 11-day window from 17 October | One operator, hundreds of targets at once |
| Result | Confirmed activity inside 9 organisations; password-spraying and credential scanning against at least 12 more | Most attempts failed. Some didn't. |
| Effort | In one intrusion, the planning agents used roughly 1.4 billion input tokens | A volume of trial and error no human team would do by hand |
| The human | An operator gave instructions at decision points; the agents tried several attack paths in parallel and switched when one failed | People set the goal. AI did the legwork. |
Coverage from Unite.AI and SecurityBrief repeats the same numbers. The targets named include foreign and interior ministries, defence, finance, pharmaceutical, semiconductor and telecoms organisations.
How did the AI agents actually get in?
This is the part worth reading twice. CrowdStrike's examples aren't science fiction. They're old, ordinary mistakes, found faster:
- Keys nobody changed. At a Greek government body, the operator gave the agent a mail-server directory export from 2022 containing authentication keys that were likely never rotated. The agent used them to forge an administrator login and read mailboxes.
- Secrets left in email. In the same case, the agent then found VPN settings in a user's sent mail and combined them with a VPN key the operator said came from a May 2024 email leak, to reach the internal network.
- Guessable passwords. Password-spraying (trying common passwords across many accounts) hit government, think-tank and company accounts.
- Weak login checks and unpatched services. At two US pharmaceutical companies, the agents exploited a login system that accepted unsigned credentials and a service that required no authentication at all.
- Computers without protection. At one company, the operator told the agents to look for Windows machines that didn't have CrowdStrike's security software installed.
Why does an AI cyberattack on governments matter to a small business?
Because the economics just changed. Until now, a careful attacker had to choose targets: there's only so much time to read old leaks, guess passwords and poke at servers. CrowdStrike's point is that agentic tools remove that limit. As the report puts it, ARTEX "enables this scale of expansion at speed."
That matters to you in three ways:
- Being small is less of a hiding place. When trying a door costs almost nothing, there's little reason to skip the small doors. This campaign targeted big organisations, but criminals copy what works, and CrowdStrike notes it has already seen ARTEX-type tools used by financially motivated groups.
- Your old leaks still count. The way into a government body came from a 2022 export and a 2024 leak. If a password of yours appeared in a breach years ago and you never changed it, that's the same door.
- Your inbox is a map. If you've ever emailed yourself a password, a Wi-Fi key or bank login, an agent that gets into your email will find it in seconds.
The good news: none of the fixes need a security team. They need a week of boring discipline. If you're wondering what an "agent framework" like ARTEX is, my explainer on what an agent harness is covers the same idea from the useful side.
How do you protect your business from AI-powered hackers?
Here's the one-week version I'd give any freelancer or small team, based on CrowdStrike's recommendations translated for a business without an IT department:
- Day 1: list your keys. Write down every account that would hurt if someone else got in: email, website, domain, bank, payments, cloud storage, social accounts, accounting software. Note who has access.
- Day 2: check for old leaks. Put your work email addresses into a breach-checking service such as Have I Been Pwned. Any account tied to a breach gets a new password, even if the breach was years ago.
- Day 3: two-step login everywhere. Turn on two-step verification (an authenticator app, not SMS where you can avoid it) on every account from Day 1. Email first, because email resets everything else.
- Day 4: get a password manager. One unique password per account, stored in a manager, shared with staff through the manager, not WhatsApp or email.
- Day 5: clean your inbox. Search your email for "password", "login", "VPN", "PIN" and "IBAN". Move anything sensitive into the password manager and delete the emails.
- Day 6: remove old access. Ex-employees, old freelancers, agencies you no longer use: remove them, and change any shared passwords they knew.
- Day 7: updates and protection. Turn on automatic updates on every laptop, phone and website plugin. Make sure every computer has up-to-date security software. If someone manages a server or website for you, ask them when it was last patched and when the keys were last changed.
Copy this prompt: your one-week security plan
Paste this into ChatGPT, Claude or Gemini. It interviews you about how your business works and turns the checklist above into a plan for your exact setup. Never paste real passwords into an AI chat.
You are a practical security advisor for a small business with no IT department. Interview me, one question at a time, to build a one-week plan to close the most common doors attackers (and their AI agents) use. MY BUSINESS: [e.g. 4-person design studio, freelance consultant] TOOLS WE USE: [e.g. Gmail, Shopify, WordPress, Xero, Slack] Ask at most 10 questions about: which accounts matter most, who has access, whether we use two-step login, a password manager, shared passwords, ex-staff or agencies with access, who manages our website or servers, and how we update devices. Never ask me for actual passwords or keys. Then produce: 1. A day-by-day plan for 7 days, max 30 minutes a day. 2. My 5 riskiest doors, ranked, with one sentence each on why. 3. The exact questions to send whoever runs our website/IT. 4. A short message I can send my team explaining the changes. Mark anything you're guessing as a guess.
The same password on email and the website since 2021. Bank details in a "notes to self" email. A former freelancer still has admin access. Nobody knows when the website was last updated.
Two-step login on every key account, unique passwords in a manager, nothing sensitive in email, old access removed, automatic updates on. An AI agent trying your doors finds them locked and moves on.
Want to use AI without opening new doors?
In a 49€ diagnostic call we look at the AI tools and accounts you already use, find the riskiest gaps, and set up a safe base before you connect AI to your email, files or website.
Book a 49€ diagnostic →Also today in AI
OpenAI rewrites the rulebook for how ChatGPT behaves
On 29 October, OpenAI published an updated Model Spec, the document that sets out how its models should behave. According to this daily digest, it now hangs off five values: faithfulness to human intent, harm minimisation, honesty and transparency, human agency, and care. It adds guidance on context, oversight and agency, clarifies how conflicts between platform, developer and user instructions get resolved, and removes much of the detailed style guidance.
What it means for you: the direction is models that use judgment when your instructions run out, rather than following them to the letter. Write instructions that explain your goal and why, not just the steps. That gets better results from any model, and it fits how OpenAI now says its models should read you.
An OpenAI-backed company agrees to buy ADT for $15.3 billion
Thrive Holdings, which is backed by OpenAI, agreed on 29 October to buy home-security company ADT in an all-cash deal at $10 a share: about $7.6 billion in equity and $15.3 billion in enterprise value, a 45.6% premium, as reported by AI Weekly. Apollo funds are providing the financing, and the deal is expected to close in the first quarter of 2027.
What it means for you: AI money is now buying traditional service businesses, betting AI can run them more efficiently. If you run a service business, your future competitor may be a big, old brand rebuilt around AI. The best defence is the same as the opportunity: start using AI on your own back office now. My post on ChatGPT moving into the back office shows where to start.
Universal Music and Udio settle and sign a licensing deal
Universal Music Group settled its lawsuit with AI music generator Udio on 29 October and signed a licensing agreement, according to AI Weekly. The settlement includes compensatory payments and plans for a licensed subscription platform for AI music creation.
How to use it: if you make videos, podcasts or ads, licensed AI music tools are where this is heading. Until they launch, check the licence terms of any AI music tool before using its tracks commercially, and keep a note of which tool and plan made each track.
FAQ
What is VAPOR PANDA?
VAPOR PANDA is the name CrowdStrike uses for a China-nexus hacking group that has targeted governments, think tanks, energy and extractive organisations in Europe, North America, Oceania and the UK since 2021. On 29 October 2026, CrowdStrike reported its first observed use of AI-driven intrusion tools.
What is ARTEX?
ARTEX is an agentic AI intrusion framework. According to CrowdStrike, a main agent coordinates planner and worker agents over a shared graph of facts, findings and goals, moving each attack from initial access through reconnaissance to lateral movement. In this campaign it ran mainly on DeepSeek plus a second, unidentified commercial model.
How many organisations did the AI-driven attack hit?
CrowdStrike says more than 200 organisations in at least 14 countries were targeted over an 11-day window starting 17 October 2026. It confirmed post-exploitation activity at nine organisations and password-spraying or credential scanning against at least 12 more.
Are small businesses at risk from AI-powered hacking?
This campaign targeted mostly governments and large companies. But the methods (unchanged old keys, guessable passwords, secrets in email, unpatched systems) are common in small businesses, and AI agents make trying many targets cheap. CrowdStrike notes similar frameworks have already been used by financially motivated groups.
How can I protect my business from AI cyberattacks?
Change passwords and keys after any leak, including old ones; turn on two-step login on every important account, starting with email; use a password manager; remove passwords and bank details from your inbox; remove access for ex-staff and old suppliers; and keep automatic updates and security software on every device.
Is it safe to paste passwords into ChatGPT or Claude to get security help?
No. Describe your setup in general terms (which tools you use, who has access, whether two-step login is on) and let the AI build a plan. Never paste real passwords, keys or bank details into any AI chat.
Set up AI on a base that's locked.
One-to-one coaching for professionals and business owners: we set up your AI tools properly, connect them only where it's safe, and make sure the accounts underneath are protected.
Book a 49€ diagnostic → Personal AI SetupSources: CrowdStrike: VAPOR PANDA Uses AI-Driven ARTEX to Grow Global Espionage Campaign (29 Oct 2026); Unite.AI (30 Oct 2026); SecurityBrief (30 Oct 2026); AI Daily Digest on DEV (OpenAI Model Spec, 29 Oct 2026); AI Weekly: AI news today (Thrive and ADT, Universal Music and Udio, 30 Oct 2026). The checklist and recommendations are mine, based on CrowdStrike's guidance.