How AI Agents Are Coordinating Intrusions Across Multiple Targets

Find the Windows machines without CrowdStrike's security sensor installed.

That was, in effect, an instruction given to an AI agent during an intrusion campaign investigated by CrowdStrike. Written in Chinese, the original instruction directed the agent to identify systems without Falcon endpoint coverage.

Researchers recovered it from attacker files exposed online. Those files revealed how one operator could coordinate AI agents across multiple intrusion targets.

The Scale of the Operation

On October 29, CrowdStrike disclosed that an adversary it calls VAPOR PANDA had used ARTEX against more than 200 organizations. One controller operated across at least 14 countries during an 11-day period. CrowdStrike confirmed post-exploitation activity at nine organizations.

Yet a subsequent CyberScoop interview introduced a discrepancy. CrowdStrike reportedly described approximately 70% of targets as compromised or showing moderate-confidence evidence of successful intrusion.

Nine confirmed cases and a possible 70% compromise figure suggest different levels of impact. The published evidence does not reconcile them.

Two days before CrowdStrike's disclosure, Trend Micro's TrendAI team had documented another agentic intrusion setup: CyberStrikeAI, configured with 44 specialized agents and associated with validation activity against at least 19 organizations.

Both investigations raise two questions: how much intrusion work can AI agents coordinate, and how much of their reported success can researchers verify?

From Automated Tools to Coordinated Agents

Attackers have long used scanners and scripts to automate repetitive tasks. Agentic frameworks add the ability to interpret results and select subsequent actions.

An agent can examine a failed command, choose another approach, and share findings with other agents. A central system maintains information across tasks and targets.

AhnLab demonstrated this capability in laboratory testing. Given a target and an objective, ARTEX selected attack paths and executed commands without intermediate human input.

Microsoft, Zscaler, and Google Threat Intelligence Group have independently documented ARTEX use by other operators. Their findings support the framework's capabilities without verifying VAPOR PANDA's specific victim counts.

Inside the Intrusion Workflows

ARTEX: Multiple Agents, Shared Findings

CrowdStrike describes ARTEX as a main agent coordinating planner and worker agents through a shared graph of facts, findings, and objectives.

Human operators establish goals. Planners identify attack paths, workers execute commands, and their findings inform subsequent decisions.

At a global pharmaceutical organization, agents reportedly combined an unsigned SAML assertion with XML external entity exploitation to access cloud instance metadata. The resulting permissions enabled cloud administration commands and recovery of an enterprise administrator account.

Another intrusion involved web-shell deployment, LAPS password retrieval, and resource-based constrained delegation abuse.

At a Greek government entity, agents used authentication keys from a 2022 directory export, which CrowdStrike assessed were likely never rotated, to forge an administrator token and access mailboxes.

These sequences show agents combining established techniques according to the environment, while humans continue directing important decisions.

CyberStrikeAI: A 44-Agent Configuration

TrendAI examined an exposed CyberStrikeAI environment containing a 44-agent configuration, a management console, and standardized target reports.

Its workflow covered reconnaissance, vulnerability validation, exploitation attempts, persistence, and exfiltration capabilities. Findings were stored centrally for review across targets.

Researchers identified validation activity involving at least 19 organizations, including at least 16 in Japan.

Recovered records included unsuccessful operations and reports indicating no exfiltration. Gizmodo Japan, relaying TrendAI's findings, described evidence of deeper compromise at only a small proportion of targets.

The configured agent count does not indicate how many agents operated simultaneously.

Why This Matters Now

The significant change is the coordination of intrusion decisions. Agents can interpret tool results, share findings, and pursue multiple attack paths without requiring human approval for every command.

The economics introduce another consideration.

CrowdStrike reported approximately 1.4 billion planning-agent input tokens in one intrusion, without disclosing the monetary cost.

In a separate campaign using the Cairn framework, NorForge estimated approximately $5,000 in model usage, or roughly $50 per successful website intrusion, according to Reuters. Those estimates are uncertain and cannot be applied to ARTEX or CyberStrikeAI.

Neither figure establishes the cost of a successful intrusion, making it difficult to assess how economically these operations can scale.

What Enterprises Should Watch

The investigations identify specific defensive priorities:

• Unexpected model API traffic: Investigate hosts contacting DeepSeek or other LLM endpoints without a legitimate business reason.
• Service-principal changes: Review credentials, owners, permissions, and privileged roles added since mid-October, particularly in environments affected by the separate Storm-0940 activity.
• Endpoint coverage gaps: Identify Windows systems without security sensors before attackers discover them.
• Cross-system activity: Connect suspicious web exploitation, credential access, cloud administration, and endpoint execution.

What Remains Unclear

CrowdStrike's nine confirmed post-exploitation cases and the approximately 70% figure reported by CyberScoop remain unreconciled.

Neither investigation provides sufficient data to measure peak agent concurrency, operator intervention frequency, or cost per successful intrusion.

TrendAI's reconstruction relied on attacker-side records, limiting independent confirmation of victim outcomes.

As Google Threat Intelligence Group researcher Rohit Nambiar told iTnews, “We have no evidence that fully autonomous (aka human out of the loop) is here yet.”

Much of what researchers know about these operations came from attackers exposing their own directories, transcripts, and management consoles.

Those mistakes made the frameworks' internal workings visible. How much comparable activity remains undetected when operators secure their infrastructure is still an open question.

Further Reading

• CrowdStrike, VAPOR PANDA Uses AI-Driven ARTEX to Scale a Global Espionage Campaign
• TrendAI / Trend Micro, Not Only ARTEX
• Microsoft Security, Storm-0940 investigation
• AhnLab ASEC
• Zscaler ThreatLabz
• Google Threat Intelligence Group, ARTEX and friends enter agentic offensive frameworks
• Reuters
• CyberScoop
• Gizmodo Japan
• iTnews