Wiz says AI agent 'ARTEX' is attacking software vendors

Wiz Research said on 22 October 2026 that it is tracking a threat actor using an AI-driven attack tool called ARTEX against multiple targeted software vendors. According to Wiz, the activity overlaps with the group tracked as Storm-0940, and the agent has been used to attack three widely deployed identity platforms: Okta, Microsoft Entra and AWS Cognito. Identity platforms control who is allowed to log into a company's systems, so they are a common first objective for intruders.

The researchers describe the targeting as an expansion into IT and software vendors, a category of victim that holds access to other organisations' environments as part of normal business. Wiz says it has observed the activity across more than one targeted vendor rather than in a single isolated case.

What makes the report notable is the tool rather than the target list. ARTEX is described by Wiz as an AI agent, meaning software that can take actions on its own towards a goal instead of simply following a fixed script. In this case the actions reported are offensive ones: probing identity services run by the companies under attack. Wiz says the agent left traces behind in the logs of the systems it touched, and that these artefacts are what the research team has been following.

That detail matters for defenders. If an automated attacker generates distinctive log patterns, those patterns become a detection opportunity for other organisations running the same identity platforms. Wiz presents its findings as an account of how the agent attacks Okta, Entra and Cognito and what it left behind, which points towards detection guidance rather than a newly disclosed software flaw.

This is not a vulnerability in Okta, Microsoft or Amazon Web Services products on the evidence published. It is a case of attacker tooling, with an AI agent being used as the instrument. No vendor named in the report has been reported as the source of a defect, and the research describes attacker behaviour against those platforms rather than a break in them.

Several questions remain open in the material published so far. Wiz has not stated publicly how many vendors were targeted, whether any of the attempts succeeded, when the campaign began, or how the agent is built and operated. There is also no public statement from Okta, Microsoft or Amazon Web Services on the activity.

Organisations running the three identity platforms named by Wiz may wish to review authentication logs for unusual automated probing while further detail emerges. Wiz says its tracking of the actor is ongoing.