--- title: "CrowdStrike tracks a China-backed AI-agent hacking campaign at 200-plus targets as security stocks sell off" description: "CrowdStrike's October 29 report catches a China-backed crew running AI penetration agents against 200-plus organizations, with intrusions confirmed or indicated at about 70 percent of targets. The same week, traders marked the security vendors down on fear that AI cuts software spending; the campaign is a demand signal pointing the other way." publisher: "The Inference" section: "Security" published: 2026-10-31T13:17:08.434Z modified: 2026-10-31T13:17:08.434Z canonical: https://theinference.org/article/crowdstrike-tracks-a-china-backed-ai-agent-hacking-campaign-at-200-plus-targets-as-security-stocks-sell-off language: en keywords: "Security, Cybersecurity, CrowdStrike, AI Agents, China" --- # CrowdStrike tracks a China-backed AI-agent hacking campaign at 200-plus targets as security stocks sell off > CrowdStrike's October 29 report catches a China-backed crew running AI penetration agents against 200-plus organizations, with intrusions confirmed or indicated at about 70 percent of targets. The same week, traders marked the security vendors down on fear that AI cuts software spending; the campaign is a demand signal pointing the other way. [CrowdStrike](https://theinference.org/markets/companies/crowdstrike) has documented the first nation-state hacking campaign it has seen run by AI agents at this scale, and the market's answer was to sell the companies that stop such crews. [Its October 29 report](https://cyberscoop.com/china-vapor-panda-agentic-ai-artex-campaign-crowdstrike/) traces Vapor Panda, a China-backed group CrowdStrike tracks, aiming an AI penetration framework at more than 200 organizations since October 17 [1][2]. About 70 percent of them were confirmed compromised or showed signs of intrusion [1]. The campaign is still running, and the week's selloff in security stocks prices its consequence exactly backwards [1][3]. ## The attacker's cost is now measured in tokens ARTEX, the framework at the center, is open source: a main agent directs planner and worker agents that pool their findings into a shared graph, running a full intrusion from reconnaissance to data theft [4]. Vapor Panda ran it on [DeepSeek](https://theinference.org/markets/companies/deepseek), the Chinese model, alongside an unidentified commercial one, with a single operator steering at decision points in instructions logged in Chinese [2][5]. The planning agents [burned 1.4 billion input tokens in one intrusion](https://thehackernews.com/2026/10/chinese-hackers-use-ai-powered-artex-to.html) [2]. Human crews that CrowdStrike has watched for 15 years peaked near 40 commands an hour [1]. This campaign passed 1,500 [1]. ## Endpoint coverage decided who survived Targets ran from foreign ministries to 19 US pharmaceutical, semiconductor, defense, nuclear and financial companies [2]. Earlier in October, [Microsoft separately tied the framework to Storm-0940](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/), another China-aligned crew, in the ConnectWise supply-chain breach, so it is already spreading between groups [4][1]. CrowdStrike counted 45 agentic attacks in September [1]. It logged 126 in October, and climbing [1]. The operator told his agents to find Windows machines without the Falcon sensor, CrowdStrike's endpoint product: visibility is what separated the victims who held from the ones who fell [5]. ## The selloff and the evidence point opposite ways On October 28, [Fortinet](https://theinference.org/markets/companies/fortinet) and [ServiceNow](https://theinference.org/markets/companies/servicenow) [cratered after hours despite beating revenue estimates](https://247wallst.com/investing/2026/10/29/software-stocks-are-getting-crushed-again-after-hours/), dragging CrowdStrike, Palo Alto and [Zscaler](https://theinference.org/markets/companies/zscaler) down about 6 percent each on the worry that AI will pull spending away from software [3]. CrowdStrike's filings show growth accelerating for five straight quarters [6][7]. Its management says companies are spending more on security because of AI, and [Citi's survey of chief information officers](https://247wallst.com/investing/2026/10/16/cybersecurity-stocks-slide-as-ai-financing-jitters-spread-palo-alto-falls-7-sentinelone-sinks-9-zscaler-drops-6/) found AI deployments driving additional security investment [6][8]. *Chart: **CrowdStrike's growth has re-accelerated five quarters in a row** Line chart of CrowdStrike quarterly revenue growth rising from 19.8 percent to 25.8 percent over five consecutive quarters* *Revenue growth year over year by calendar quarter, US dollars, from CrowdStrike's SEC filings. [7]* ## A demand document written at machine speed The same reporting [names four new China-linked groups](https://theinference.org/article/crowdstrike-says-four-hacking-groups-now-run-ai-agents-on-their-own-its-aidr-line-grew-79-fold) and a chain through [Intapp](https://theinference.org/markets/companies/intapp)'s legal billing software that reached law firms, so the exposure keeps widening [2]. CrowdStrike's own read is blunt: nothing here is technically new, only faster, and the defense is visibility into endpoints and identities [1]. That visibility is what the discounted vendors sell, and defending at machine speed is an AI build-out, not a reason to retreat from one. The scarce skill already shows in the transcripts, where the attacker's edge was knowing where to point the machine and reading its output fast enough to steer [5]. Traders sold the sector fearing AI shrinks software budgets. The week's best-documented fact is attackers forcing them to grow. ## Takeaway A China-backed crew ran AI agents against 200-plus organizations at 1,500-plus commands an hour, with intrusions confirmed or indicated at about 70 percent of targets; that is evidence AI raises security demand, the opposite of what the week's selloff priced. ## Sources 1. [CyberScoop, China-backed threat group used agentic AI pentesting tool to compromise 140 sensitive targets in 11 days, 30 October 2026](https://cyberscoop.com/china-vapor-panda-agentic-ai-artex-campaign-crowdstrike/) 2. [The Hacker News, Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide, 30 October 2026](https://thehackernews.com/2026/10/chinese-hackers-use-ai-powered-artex-to.html) 3. [24/7 Wall St, Software Stocks Are Getting Crushed Again After Hours, 29 October 2026](https://247wallst.com/investing/2026/10/29/software-stocks-are-getting-crushed-again-after-hours/) 4. [Microsoft Security Blog, AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise, 21 October 2026](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/) 5. [Unite.AI, China-Nexus VAPOR PANDA Breached Nine of 200-Plus Targets With AI Agents, 30 October 2026](https://www.unite.ai/china-nexus-vapor-panda-breached-nine-of-200-plus-targets-with-ai-agents/) 6. [Yahoo Finance (Trefis), How Bad Would Cooling AI Security Demand Be For CrowdStrike Stock?, 27 October 2026](https://finance.yahoo.com/markets/stocks/articles/bad-cooling-ai-security-demand-103906385.html) 7. [CrowdStrike, quarterly figures from its SEC filings, retrieved 31 October 2026](https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001535527) 8. [24/7 Wall St, Cybersecurity Stocks Slide as AI Financing Jitters Spread: Palo Alto Falls 7%, SentinelOne Sinks 9%, Zscaler Drops 6%, 16 October 2026](https://247wallst.com/investing/2026/10/16/cybersecurity-stocks-slide-as-ai-financing-jitters-spread-palo-alto-falls-7-sentinelone-sinks-9-zscaler-drops-6/) --- CrowdStrike tracks a China-backed AI-agent hacking campaign at 200-plus targets as security stocks sell off — The Inference. Canonical: https://theinference.org/article/crowdstrike-tracks-a-china-backed-ai-agent-hacking-campaign-at-200-plus-targets-as-security-stocks-sell-off