Chinese hackers used open-source ARTEX AI to attack 200 organisations

Chinese hackers used ARTEX, an open-source multi-agent AI penetration-testing framework, in automated attacks against more than 200 organisations in 14 countries, according to a report published by BleepingComputer on 2 November 2026.

ARTEX is described in the report as a multi-agent framework, meaning it coordinates several AI agents that each take on part of a task and pass results between them. It is built for penetration testing, the legitimate practice of attacking a system with permission to find weaknesses before criminals do. In this case, according to the report, the tooling was turned on targets that had not consented.

The case is an example of tool misuse rather than a software flaw. Nothing in the report points to a vulnerability in ARTEX itself. The framework is open source, so anyone can download, run and modify it, and the attackers appear to have used it broadly as intended, only against the wrong targets. That distinction matters for defenders, because there is no patch to apply for a tool working as designed.

The scale reported is the most striking detail. More than 200 organisations across 14 countries is a wide campaign by the standards of hands-on-keyboard intrusion work, where each target normally consumes analyst time. Automation through agents is the plausible explanation for that spread, though the report does not set out how much of the activity ran without human supervision, how many of the 200 organisations were successfully compromised, or what the attackers took.

Several other details remain unclear from the available reporting. The report does not state which sectors or countries were affected, when the activity began or how long it ran, or which group was behind it beyond describing the operators as Chinese hackers. The Agentic Times has not independently verified the claims and is not attributing the campaign to any named group or government body on the basis of this report alone.

For security teams, the practical takeaway is narrow but useful. Offensive AI frameworks that are published openly for red teams are available to everyone else on the same terms. Detection logic tuned to the pacing and habits of human testers may miss activity that moves faster and runs in parallel across many hosts. Organisations that already monitor for known penetration-testing tooling may want to check whether agent-driven frameworks are covered by the same signatures and alerting rules.

More detail may emerge as other researchers examine the campaign. Until then, the reported figures of 200 organisations and 14 countries rest on the single published account.