Hundreds of Offensive AI Agent Instances Detected Across Global VPS Platforms

A security researcher has identified hundreds of instances of the ARTEX agentic AI framework deployed across virtual private server providers including Cogent, ColoCrossing, DigitalOcean, Vultr and Linode, indicating a large-scale effort to build a distributed network for cyberattacks. The instances shared an identical ETag and Content-Length, suggesting deployment from the same Docker image or template, following a campaign by China-linked hacking groups that used ARTEX to automate intrusions against Microsoft 365 tenants.