---
format: "aidr-story-markdown/v1"
id: "a37a7967c898555b79c41383872f866320e89e3c9a9e17e6ea54320800f22b83"
canonical_url: "https://aidr.today/a37a7967?lang=en"
title: "Hundreds of Offensive AI Agent Instances Detected Across Global VPS Platforms"
lang: "en"
requested_lang: "en"
available_langs: ["en","vi"]
translation_fallback: null
fallback_fields: []
published_at: "2026-11-04T02:08:06.000Z"
category: "Agents"
topics: ["agent"]
source_urls: ["https://marketbrief.now/cybersecurity/hundreds-of-offensive-ai-agent-instances-detected-across-global-vps-plat-dfd5df4f","https://x.com/p_misirov/status/2117676598866714972","https://x.com/MsftSecIntel/status/2112975078266716390","https://x.com/TheHackersNews/status/2116579562687774785","https://x.com/saranormous/status/2113108378486813036","https://x.com/martin_casado/status/2113117450065887657","https://x.com/rohanpaul_ai/status/2113113477552169349","https://x.com/kimmonismus/status/2113183576401547509"]
summary: "A security researcher has identified hundreds of instances of the ARTEX agentic AI framework deployed across virtual private server providers including Cogent, ColoCrossing, DigitalOcean, Vultr and Linode, indicating a large-scale effort to build a distributed network for cyberattacks. The instances shared an identical ETag and Content-Length, suggesting deployment from the same Docker image or template, following a campaign by China-linked hacking groups that used ARTEX to automate intrusions against Microsoft 365 tenants."
---

# Hundreds of Offensive AI Agent Instances Detected Across Global VPS Platforms

> [Open the canonical story](<https://aidr.today/a37a7967?lang=en>)

**Published:** 2026-11-04T02:08:06.000Z
**Category:** Agents
**Topics:** agent

## Summary

A security researcher has identified hundreds of instances of the ARTEX agentic AI framework deployed across virtual private server providers including Cogent, ColoCrossing, DigitalOcean, Vultr and Linode, indicating a large\-scale effort to build a distributed network for cyberattacks\. The instances shared an identical ETag and Content\-Length, suggesting deployment from the same Docker image or template, following a campaign by China\-linked hacking groups that used ARTEX to automate intrusions against Microsoft 365 tenants\.

## Sources

- [Story source](<https://marketbrief.now/cybersecurity/hundreds-of-offensive-ai-agent-instances-detected-across-global-vps-plat-dfd5df4f>)
- [Story source](<https://x.com/p_misirov/status/2117676598866714972>)
- [Story source](<https://x.com/MsftSecIntel/status/2112975078266716390>)
- [Supporting source](<https://x.com/TheHackersNews/status/2116579562687774785>)
- [Supporting source](<https://x.com/saranormous/status/2113108378486813036>)
- [Supporting source](<https://x.com/martin_casado/status/2113117450065887657>)
- [Supporting source](<https://x.com/rohanpaul_ai/status/2113113477552169349>)
- [Supporting source](<https://x.com/kimmonismus/status/2113183576401547509>)