Canada’s cyber watchdog is raising the alarm and a China-linked group’s attack on 2,250 Microsoft tenants proves the threat is no longer theoretical.
Agentic AI is now directly linked to a rise in cyberattacks and Canada’s own cybersecurity agency is sounding the alarm. The Canadian Centre for Cyber Security (CCCS) issued a formal advisory in October 2026 warning that agentic AI systems are accelerating the speed and scale of attacks by connecting multiple stages of an intrusion together autonomously. The warning was not theoretical. Within the same month, a China-state-aligned hacking group used an AI agent framework to target more than 2,250 Microsoft 365 customer accounts in a matter of hours.
This is a turning point. For years, AI-powered cyberattacks were a future risk discussed at conferences. Now they are a documented, active threat confirmed by a national security agency, evidenced by a real supply chain breach, and quantified by industry data showing breakout times collapsing from hours to minutes.
Bank of America Warns Against Sharing Banking Passwords With AI
This article breaks down what the CCCS said, what actually happened in the Storm-0940 attack, what the numbers mean, and most importantly what your organization needs to do about it.
What Is Agentic AI — and Why Does It Change Cyberattacks?
Before getting into the CCCS advisory, it helps to understand what makes agentic AI different from ordinary AI tools because the difference is what makes it dangerous.
Traditional AI models respond to a single prompt. You ask, it answers. Agentic AI goes further: it can set its own sub-goals, call external tools, take actions in real digital environments, and chain multiple tasks together all with limited human direction. Think of it as the difference between asking a human assistant one question versus handing that assistant a master key and telling them to “handle it.”
“Agentic AI accelerates cyberattacks by linking multiple stages of an attack together — what defenders call the kill chain.”— Canadian Centre for Cyber Security (CCCS), Advisory, October 2026
Every cyberattack follows a sequence of steps security professionals call it the kill chain. It typically includes reconnaissance (finding targets), initial access (getting in), credential abuse (stealing identities), lateral movement (spreading across a network), and data exfiltration (taking what you came for). Historically, each step required human effort and time. That time was the defender’s window to detect and stop the attack.
Agentic AI removes much of that time. An AI agent can autonomously handle multiple kill chain stages in parallel, working around the clock without pausing. It does not get tired, does not need sleep, and does not slow down because a human operator has gone offline. As CCCS head Rajiv Gupta confirmed at the Cisco Connect Canada 2026 event in Toronto, “We do see AI enhancing and being used across different elements in the kill chain.”
What Canada’s Cybersecurity Agency Actually Said
The Canadian Centre for Cyber Security is part of the Communications Security Establishment Canada — the country’s national cryptologic agency. It issues formal advisories on cyberthreats and vulnerabilities. Its October 2026 warning on agentic AI is significant precisely because of the agency’s institutional standing: this is not commentary from a private security vendor. It is a government assessment.
OpenAI Faces Backlash Over Research Secrecy and Transparency
Three Core Findings
The advisory made three main points. First, agentic AI is already being used across different elements of the kill chain in real attacks. Second, although AI-enabled cyberattacks are currently detectable by sophisticated defenders, the technology will make malicious activity more targeted and harder to detect as it improves. Third and critically agentic AI does not make established cybersecurity practices obsolete. It makes them more urgent.
“AI increases the consequences of weak controls and slow decisions, but the fundamentals of good cybersecurity remain effective.”— CCCS Advisory, October 2026
That third point deserves emphasis. A common reaction to new threats is to declare that everything has changed and that new solutions are needed. The CCCS is taking the opposite position: the basics work — they just need to be applied faster and more thoroughly, because the cost of failing to apply them has risen sharply.
Canada Was Already a Target
The October advisory was not the first signal. In October 2026, AI research firm Transluce identified an attempted breach of Library and Archives Canada (LAC) using what appeared to be OpenAI-style agents. Transluce captured 899 requests hitting LAC’s collection search service, 13 of which carried attack payloads probing for vulnerabilities. The attempt failed, and the CCCS confirmed there was no indication of compromise. Nevertheless, the incident demonstrated that Canadian government systems are active targets for AI agent-based probing.
The CCCS had also co-authored two major guidance documents earlier in 2026. In March, it published its Top 10 Artificial Intelligence Security Actions (ITSAP.10.049). Then in May 2026, as part of a Five Eyes coalition, it co-published guidance specifically covering agentic AI risks, the first of its kind.
Storm-0940 and ARTEX: The Attack That Made It Real
On October 22, 2026, Microsoft disclosed the details of a sophisticated supply chain cyberattack and the disclosure made the CCCS warnings concrete. A China-state-aligned hacking group tracked as Storm-0940 had used an agentic AI framework called ARTEX to automate and accelerate attacks against hundreds of organizations globally.
What ARTEX Is
ARTEX is an open-source, multi-agent AI penetration testing framework written in the Go programming language, with a Next.js frontend. Crucially, it is model-agnostic, it can run on any AI model. It was designed to handle penetration testing tasks autonomously, from initial reconnaissance through to data extraction attempts, across multiple targets simultaneously. In October 2026, it was also reported in connection with data breaches at South Korean financial institutions and Japanese companies across multiple sectors confirming that its use extended well beyond one group or one campaign.
How Storm-0940 Used It
Storm-0940 has been active since 2021, historically relying on password spraying and exploitation of internet-facing applications. What changed in September 2026 was the introduction of ARTEX into its operations. Microsoft assessed that Storm-0940 began using the framework starting that month to automate attacks against hundreds of organizations across aerospace, defense, energy, financial services, technology, think tanks, and nonprofits.
- Sep 2026
ARTEX deployed at scaleStorm-0940 begins using the agentic AI framework against hundreds of organizations globally. Targets span aerospace, defense, energy, finance, and technology.
- Oct 1–14
Password-spray campaignStorm-0940 infrastructure runs an automated cross-tenant password-spray campaign targeting 327 accounts across eight organizations, generating 151,000+ failed logon events at up to 2,900 attempts per minute.
- Oct 15
ConnectWise supply chain breachStorm-0940 uses ARTEX to compromise ConnectWise Cloud Backup application credentials. Agents authenticate to more than 2,250 Microsoft 365 customer tenants. Privileged cloud persistence is achieved at multiple organizations in under three hours.
- Oct 16
ConnectWise advisory publishedConnectWise issues public advisory covering attempted unauthorized access. Customers are advised to disable affected application connections until formal restoration guidance is issued.
- Oct 22
Microsoft discloses Storm-0940 linkMicrosoft publishes detailed threat intelligence attributing the ConnectWise breach to Storm-0940 and documents ARTEX’s role in the campaign.
Why 2,900 Attempts per Minute Matters
The operational tempo of ARTEX is the detail that deserves the most attention. In its password-spray phase alone, Storm-0940’s infrastructure was making 2,900 sign-in attempts per minute. At that rate, a human security analyst who spots an alert at minute one and follows standard incident response procedures escalate, verify, contain may already be too late to prevent lateral movement. The math does not favor manual defense.
Furthermore, the ARTEX deployment included AI assistant configurations, synchronization scripts, and network routing tools. Microsoft’s analysis noted that one version of the deployment also contained a Claude Code prompt history illustrating how publicly available AI coding tools can be incorporated into offensive frameworks, regardless of the developer’s intentions.
The Speed Problem: Numbers That Redefine Defense
The Storm-0940 incident is a case study. The broader pattern is captured in industry data and those numbers are alarming in their own right.
CrowdStrike 2026 Global Threat Report
CrowdStrike’s 2026 Global Threat Report, published in February 2026, drew from real-world intrusions, incident response engagements, and threat intelligence across thousands of organizations worldwide. Its headline finding was the collapse of breakout time, the window between an attacker’s initial access and their first lateral movement inside a target network.
In 2021, the average breakout time was 98 minutes. In 2024, it had fallen to 48 minutes. In 2025, it dropped to 29 minutes — a 65% acceleration in a single year. The fastest observed breakout in the dataset occurred in just 27 seconds. AI-enabled adversaries increased their operations by 89% year-over-year.
“This is an AI arms race. Breakout time is the clearest signal of how intrusion has changed. Adversaries are moving from initial access to lateral movement in minutes. Security teams must operate faster than the adversary to win.”— Adam Meyers, Head of Counter Adversary Operations, CrowdStrike
| YEAR | AVG BREAKOUT TIME | CHANGE | KEY DRIVER |
|---|---|---|---|
| 2021 | 98 minutes | — | Manual attacker workflows |
| 2024 | 48 minutes | −51% | Generative AI for scripting and recon |
| 2025 | 29 minutes | −40% (65% YoY faster) | Agentic AI frameworks, automated credential abuse |
| Record low | 27 seconds | — | Fully automated agentic attack chain |
Microsoft and IBM Data
Microsoft’s 2026 Digital Defense Report confirmed the same acceleration pattern inside cloud environments and SaaS platforms. IBM’s analysis of Canadian breach costs added a financial dimension: Canadian organizations that extensively used security AI and automation reported average breach costs of CA$5.19 million, compared to CA$8.53 million for those that did not a CA$3.34 million spread. Investing in AI-augmented defense is not just a security decision; it is a financial one.
Meanwhile, 70% of Canadian IT professionals surveyed by CIRA said they were worried about new AI cyber threats, and 61% cited AI-powered phishing specifically. That concern is well-founded. Agentic AI can generate highly personalized phishing content at scale, targeting each individual in an organization with tailored messaging drawn from publicly available data at a volume and customization level no human attacker team could sustain.
What International Agencies Are Recommending
The CCCS did not act alone. In May 2026, five national cybersecurity agencies, Canada (CCCS), the United States (CISA), the United Kingdom (NCSC), Australia (ASD), and New Zealand (NCSC-NZ) — published a joint guidance document: Careful Adoption of Agentic AI Services. It was the first Five Eyes guidance document written specifically for the risks of agentic AI systems.
The guidance addressed two main questions: how to deploy agentic AI securely, and how to operate it securely once deployed. Its core message aligned with the CCCS advisory’s third finding: the fundamentals of cybersecurity work. The challenge is applying them to a new category of system one that acts autonomously, chains tools together, and can make decisions with consequences that propagate across connected environments.
How to Defend Against Agentic AI Cyberattacks
The CCCS advisory is explicit: established cybersecurity practices remain effective. The following steps are drawn from CCCS guidance, the Five Eyes joint advisory, and the Microsoft incident analysis of the Storm-0940 campaign.
How to Defend Against Agentic AI Cyberattacks
- Apply least-privilege access to every AI agentRestrict what AI agents and their connected tools can access. An agent handling customer support emails does not need access to your finance systems. Every permission not granted is one an attacker cannot abuse.
- Monitor all AI agent activity continuouslyLog every action taken by AI agents — tool calls, API requests, file access, network connections. Review those logs automatically. Agentic systems can behave unexpectedly; continuous monitoring is your earliest detection layer.
- Enforce multi-factor authentication everywhereStorm-0940 ran 2,900 password-spray attempts per minute. MFA stops that attack vector entirely. Apply it to all accounts, especially admin accounts and cloud service accounts.
- Audit all third-party application OAuth accessStorm-0940 used ConnectWise’s pre-authorized application credentials to authenticate to customer environments without needing individual account passwords. Review which applications have been granted access to your cloud environments and revoke anything no longer needed.
- Write down an incident response plan — nowOnly 26% of Canadian businesses had a written cybersecurity policy as of 2023. When breakout time is 29 minutes, you cannot improvise a response. The plan needs to exist before the incident, and it needs to specifically account for AI agent-driven attack scenarios.
- Read the Five Eyes Agentic AI guidanceThe Careful Adoption of Agentic AI Services guidance from CCCS and its Four Eyes partners is the most authoritative public document on this topic. It is free and available at cyber.gc.ca.
AI Is Now Both the Threat and the Defense
There is an uncomfortable paradox at the heart of the agentic AI security problem. The same technology that is being weaponized by attackers is also the best available tool for defenders. IBM’s data shows that AI-augmented security operations reduce breach costs by CA$3.34 million on average. CrowdStrike’s automated detection systems are the only realistic way to match the speed of AI-driven intrusions. When breakout time falls to 27 seconds, human-only response chains cannot keep up.
This creates a dynamic that will define cybersecurity for the next decade: defenders who adopt AI-augmented security tools will have a structural advantage over those who do not. Meanwhile, attackers who adopt agentic frameworks like ARTEX gain speed and scale advantages over defenders who have not yet upgraded their response capabilities. The gap between the two groups is widening.
For Nigerian and African organizations integrating AI tools into operations in fintech, healthcare, logistics, and government services this pattern is directly relevant. The agentic AI attack surface is not geography-dependent. Any cloud-connected system, any Microsoft 365 tenant, any organization using third-party applications with OAuth permissions is a potential target. The Storm-0940 campaign targeted hundreds of organizations across a broad range of industries globally. “Global” means Africa too.
“AI now lets attackers test connections at machine speed. MSPs are in the middle of that chain. They are targets in their own right, and they are also a path into every client they serve.”— Microsoft Threat Intelligence, October 2026
Finally, the CCCS advisory ends on a note that is worth repeating to every security team, every board, and every organization that believes AI threats are someone else’s problem: “AI increases the consequences of weak controls and slow decisions.” That sentence is not a warning about a future state. It describes the current one.
Frequently Asked Questions
1. What is agentic AI in cybersecurity?
Agentic AI refers to AI systems that can make decisions, chain multiple tasks together, and use external tools with minimal human supervision. In cybersecurity, this means an agent can independently handle multiple stages of a cyberattack scanning for vulnerabilities, stealing credentials, moving laterally across networks without a human directing each step. This is what makes it more dangerous than ordinary AI tools, which only respond to individual prompts.
2. What did Canada’s CCCS say about agentic AI and cyberattacks?
The Canadian Centre for Cyber Security issued an advisory in October 2026 warning that agentic AI is accelerating cyberattacks by linking multiple stages of an attack together — the kill chain. CCCS head Rajiv Gupta confirmed the agency is seeing AI used across different kill chain elements. The advisory noted that while AI-enabled attacks are currently detectable by sophisticated defenders, they will become more targeted and harder to spot as the technology improves. The CCCS stressed that existing cybersecurity fundamentals remain effective but must be applied faster and more rigorously.