China-aligned hackers used AI agent framework in ConnectWise supply chain attack

Microsoft says the China-aligned group Storm-0940 used the ARTEX AI agent framework in a supply chain attack on ConnectWise Cloud Backup. The attack is described as massive in scope.

Why it matters: This is a documented case of state-linked actors putting agent frameworks into a supply chain operation, not just phishing text. It fits the pattern in Symantec's findings on hijacked agents and the Army's work on self-spreading agents: offensive use of agents is moving from experiment to routine tradecraft. Defenders of managed-service and backup vendors should assume faster, more automated intrusion tempo.