Severity major: Prompts referenced organizations in 19 countries and territories, an unbounded multi-country scope, though compromise was not established.
Earliest source we hold 2026-10-26 · Captured by AI Risk Wire 2026-10-28 13:17 UTC
Zscaler's ThreatLabz reported an AI-assisted hacking campaign in which an operator customized the open-source ARTEX penetration-testing framework and used AI coding environments (Claude Code, Codex) with models from DeepSeek, GLM and Grok to scan networks, test vulnerabilities and analyze Android apps.
Risk grouping: Not yet classified
No source we hold states: who caused it, intended or not, before or after release, the ai's part.
The story
1 · What it was doingAn operator ran a customized ARTEX penetration-testing framework with Claude Code and Codex and models from DeepSeek, GLM and Grok, using agents to scan networks, test vulnerabilities, review code and analyze Android apps.
2 · What went wrongThe AI tools were used to pursue unauthorized intrusion against real organizations, with prompts treating targets as already authorized and some configurations permitting actions without operator approval.
3 · What it reached or didPrompts referenced organizations in 19 countries across financial services, cryptocurrency, retail, education and logistics, seeking personal information, financial records and database contents; compromise was not established.
4 · How it was caughtZscaler's ThreatLabz researchers found the activity by examining configuration files, scripts and AI prompt histories recorded between August 4 and October 4.
What the sources state
What set it off misused by a person
No source states: when it happened, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what was done.