---
format: "aidr-story-markdown/v1"
id: "d9f06a7b29cad58f91fc0b1cf19fd602ecd9ac2781d2773551dd2e326a91e3ea"
canonical_url: "https://aidr.today/d9f06a7b?lang=en"
title: "Researcher Finds Backdoor in GitHub Repository for AI Attack Tool ARTEX"
lang: "en"
requested_lang: "en"
available_langs: ["en","vi"]
translation_fallback: null
fallback_fields: []
published_at: "2026-11-04T22:23:50.000Z"
category: "Open Source"
topics: ["microsoft","open-source","agent"]
source_urls: ["https://marketbrief.now/cybersecurity/researcher-finds-backdoor-in-github-repository-for-ai-attack-tool-artex-49d3b4db","https://x.com/MsftSecIntel/status/2112975078266716390","https://x.com/p_misirov/status/2117676598866714972","https://x.com/Zaddyzaddy/status/2117706637754409335","https://x.com/CyberScoopNews/status/2116997707269046603","https://x.com/blackroomsec/status/2118103866394775661","https://x.com/rohanpaul_ai/status/2113113477552169349","https://x.com/kimmonismus/status/2113183576401547509"]
summary: "The open-source code for ARTEX, an AI-powered penetration testing framework, contains a backdoor in its GitHub repository. Microsoft and CrowdStrike have linked the tool to Chinese state-aligned hacking groups, specifically Storm-0940 and Vapor Panda. These actors used ARTEX to target more than 2,250 Microsoft 365 tenants."
---

# Researcher Finds Backdoor in GitHub Repository for AI Attack Tool ARTEX

> [Open the canonical story](<https://aidr.today/d9f06a7b?lang=en>)

**Published:** 2026-11-04T22:23:50.000Z
**Category:** Open Source
**Topics:** microsoft, open\-source, agent

## Summary

The open\-source code for ARTEX, an AI\-powered penetration testing framework, contains a backdoor in its GitHub repository\. Microsoft and CrowdStrike have linked the tool to Chinese state\-aligned hacking groups, specifically Storm\-0940 and Vapor Panda\. These actors used ARTEX to target more than 2,250 Microsoft 365 tenants\.

## Sources

- [Story source](<https://marketbrief.now/cybersecurity/researcher-finds-backdoor-in-github-repository-for-ai-attack-tool-artex-49d3b4db>)
- [Story source](<https://x.com/MsftSecIntel/status/2112975078266716390>)
- [Story source](<https://x.com/p_misirov/status/2117676598866714972>)
- [Story source](<https://x.com/Zaddyzaddy/status/2117706637754409335>)
- [Supporting source](<https://x.com/CyberScoopNews/status/2116997707269046603>)
- [Supporting source](<https://x.com/blackroomsec/status/2118103866394775661>)
- [Supporting source](<https://x.com/rohanpaul_ai/status/2113113477552169349>)
- [Supporting source](<https://x.com/kimmonismus/status/2113183576401547509>)