Security reporting indicates that attackers described as Chinese hackers used ARTEX, an open-source AI penetration-testing framework, in attacks against more than 200 organisations in 14 countries. While the source report focuses on the threat activity itself, the broader business takeaway is clear: AI-based tools are increasingly being used to automate parts of offensive security work that previously required more manual effort.

What happened

According to the report, the attackers used ARTEX, a multi-agent framework designed for penetration testing, during campaigns against a large number of organisations. Open-source offensive security tools are not new, but the reported use of an AI-enabled framework is notable because it suggests attackers may be able to speed up tasks such as reconnaissance, identifying weaknesses, prioritising attack paths and coordinating repeated attempts at scale.

Based on the source, the campaign affected organisations across multiple countries. The report does not mean every business faces the same level of risk, and it does not on its own establish that AI was responsible for every stage of the intrusions. However, it does indicate that AI-assisted attack workflows are moving further into real-world operations.

Why it matters for European businesses

For European companies, this development matters because automation can lower the time and cost needed for attackers to probe internet-facing systems. That can increase the volume, frequency and sophistication of attacks against websites, cloud services, remote access tools and business applications.

For SMEs in particular, the practical concern is not only highly advanced nation-state activity. Techniques and tools used in larger campaigns often spread more widely over time. When AI helps automate scanning, enumeration and exploitation attempts, smaller organisations with limited security staffing may face more pressure on detection and response.

This is also relevant for businesses working with agencies, SaaS platforms and outsourced IT suppliers. If an external provider exposes a weak point in a company’s digital stack, automated attackers may find it faster. In sectors with regulatory obligations, a successful intrusion could also create follow-on GDPR, contractual or operational risks depending on the systems and data involved.

Who may be affected

The reported activity is relevant to a broad set of organisations, but some groups should pay particular attention:

• SMEs with internet-facing systems
  Companies running public websites, e-commerce platforms, VPNs, remote desktop services or self-managed servers may be exposed to automated reconnaissance and exploitation attempts.
• IT and security teams
  Teams responsible for endpoint protection, vulnerability management, identity controls and log monitoring may need to account for faster attack cycles.
• E-commerce and digital businesses
  Online stores and digitally dependent companies can face direct revenue disruption if customer-facing systems are compromised or taken offline.
• Regulated organisations and supply-chain participants
  Businesses handling sensitive data or operating in regulated sectors may face wider legal, customer and supplier implications after an incident.

What companies should consider

The report does not by itself create new legal obligations, but it does reinforce several practical security priorities for European businesses:

• Review exposure of internet-facing assets
  Maintain an up-to-date inventory of websites, servers, admin panels, cloud workloads and remote access services.
• Accelerate patching of known vulnerabilities
  Automated attack workflows are more dangerous when public-facing systems lag on security updates.
• Strengthen identity protections
  Use multi-factor authentication, reduce privileged access where possible and review administrator accounts and third-party access.
• Improve monitoring and alerting
  Look for unusual scanning, repeated login attempts, suspicious command execution and unexpected activity across endpoints and cloud environments.
• Test incident response readiness
  Ensure teams know how to isolate affected systems, preserve logs, contact providers and assess data exposure if an intrusion is suspected.
• Assess supplier and hosting dependencies
  Ask critical vendors and managed service providers how they monitor AI-assisted attack patterns and how quickly they apply patches and mitigations.

For business leaders, the key message is that AI in cybersecurity is no longer only a defensive productivity tool. It is also becoming part of the attacker toolkit. That makes baseline security discipline, visibility across digital assets and faster operational response more important for organisations of all sizes.