The Attacker Now Runs a Team of Agents, Not a Keyboard

The familiar image of an intrusion is a person at a keyboard, typing commands one at a time, deep into the night. CrowdStrike account of a global espionage campaign, published October 29, 2026, retires that image. On the other side of the wire now sits a small team, and most of the team is software.

On October 29, 2026, CrowdStrike published its account of a global espionage campaign attributed, on CrowdStrike assessment, to VAPOR PANDA, a China-nexus adversary tracked since 2021. Beginning October 17, a single controller running the ARTEX agentic framework was directed against more than 200 organisations in at least 14 countries over an 11-day window. CrowdStrike confirmed post-exploitation activity at nine organisations, and the campaign was still active at publication.

We treat the numbers in the report as CrowdStrike numbers, reported as such, and the architecture as the durable lesson. Attribution and target counts belong to the source. The design of the attacking system, planner and worker agents over a shared graph with a human steering, is a pattern any builder of legitimate agent systems will recognise on sight, and recognition is where defence has to start.

01 · The report

The target list describes an espionage campaign, not opportunistic crime: foreign ministries, a European country presidency and prime minister office, defence and intelligence bodies, semiconductor and pharmaceutical firms, think tanks and telecommunications providers. Nine organisations with confirmed post-exploitation activity, out of more than 200 targeted, also describes the arithmetic of defence at scale. Most targets held; the campaign only needed the few that did not.

The timeline compresses the lesson. Eleven days, one controller, many parallel engagements, each tracked as its own task. A human team working that breadth would need shifts, hand-offs and sleep. The framework needed none of those, and the operator attention went only to the decision points where judgement changed the outcome.

02 · Inside ARTEX

The architecture will look familiar to anyone building legitimate agent systems, and that familiarity is the point. ARTEX coordinates a main agent with subordinate planner and worker agents over a shared graph of facts, findings and goals, advancing each engagement from initial access through host reconnaissance to lateral movement. A human operator stays in the loop, intervening at decision points; recovered transcripts show the operator directing agents to write web shells, extract domain administrator passwords and inventory endpoint sensor coverage. Multiple engagements ran in parallel against different targets, each tracked as its own task: a small team, multiplied by software.

We note the shared graph with professional respect and professional alarm. A shared graph is how a team keeps common ground: what is known, what is guessed, what remains to try. Legitimate agent programmes, including the agent work studied through Hugging Face Agents certification, use the same coordination logic for the same reason. The tooling is neutral. The intent, the targets and the authority behind the tooling are not.

The tradecraft is established; the speed and parallelism are new.

03 · Scale, in numbers

Two figures measure the shift. In a single intrusion, the planning agents consumed on the order of 1.4 billion input tokens, CrowdStrike reports, a scale of automated reasoning no keyboard team sustains. And the tempo: hands-on-keyboard activity tracked over fifteen years typically ran at up to about 40 commands per hour; with ARTEX, that pace could exceed 1,500 commands per hour, CrowdStrike Adam Meyers told CyberScoop, with requests arriving as often as every ten seconds. CrowdStrike also counted agentic adversary attacks rising from roughly 45 in September to 126 in October.

The budget conversation changes with those figures. A planning layer that can spend on the order of 1.4 billion input tokens on one intrusion makes automated reasoning cheap for the side that runs the layer and expensive for the side that answers by hand. Matching the tempo does not require matching the recklessness. Defender agents operate inside known estates, with ground truth an attacker has to discover, but the tempo itself is no longer optional.

04 · The counter-design

Defence has to answer in kind, organised, observable and fast, and the counter-design is already visible in the same architecture, inverted. Least privilege shrinks what any single agent, account or session can reach. Expiring credentials close the window that stolen access depends on. Observable state, shared graphs of facts and findings maintained for defenders, turns detection into a race between two teams of agents rather than a watch kept by tired eyes alone.

The Staywired Technology Coordinator years taught the perimeter version of that lesson; NVIDIA-Certified Professional: AI Operations teaches the agent version: instrument the system, bound the authority, rehearse the response. Operations centres will staff agent fleets the way earlier generations staffed watch rotations, and the craft moves from watching every event to designing the bounds inside which fast machines may act.

05 · What to watch

CrowdStrike assesses that agentic frameworks will keep spreading among state-nexus adversaries, and the same ARTEX tooling has already appeared under separate attribution elsewhere, a sign of a maturing ecosystem rather than a single campaign. Watch for defender-side agent teams moving from conference talks into standard practice, for token-scale telemetry becoming a detection signal in its own right, and for identity controls, short-lived credentials and scoped sessions, becoming the control plane where these contests are actually decided.

We close with the plain version. The attacker now runs a team of agents, not a keyboard, and the team does not tire, does not lose the thread between shifts and does not forget a finding recorded in the graph. Defence that reasons in single alerts will lose to defence that reasons in teams. Building the defender team, bounded and observable, is the work now.