How AI-Accelerated Attacks Change Cloud Defense and Secure Code Review

What Happened

Microsoft attributes a campaign targeting hundreds of organizations to China-state-aligned Storm-0940. Microsoft says the actor used the agentic penetration-testing framework ARTEX to accelerate scanning, password spraying and OAuth application abuse, and assesses that the actor was responsible for a disclosed ConnectWise supply-chain compromise. Some attacks reached privileged cloud access in under three hours. Compromised application identities were subsequently used in sign-in attempts across more than 2,250 tenants. Microsoft says the activity did not result from a vulnerability or compromise in its services; a successful sign-in alone does not establish data access or exfiltration [1].

Unit 42 separately investigated an actor who bypassed AI safety controls to assist with credential theft, VoIP-fraud planning and database exfiltration [4]. On the defensive side, Trail of Bits found 21 regressions in a review of more than 130 upstream-merged, engineer-authored security patches and released tools for invariant-guided patching and regression checks [3]. Unit 42 also reported two critical PHP vulnerabilities, but the available brief gives no affected versions or technical details [2].

Why It Matters to Businesses

AI can shorten the time between discovery and attempted exploitation without introducing a novel vulnerability. The ConnectWise case makes third-party application identities, OAuth grants and privileged cloud access immediate priorities for identity monitoring [1]. Meanwhile, AI-assisted repair does not remove the need to test what a patch changes outside the targeted bug: Trail of Bits confirmed functional, performance and build/test regressions, although none broke a security protection in its review [3].

Kimbodo Engineering Perspective

Treat AI as an accelerator, not a separate security perimeter. Defenses still depend on scoped permissions, observable actions and verified changes. Detection must distinguish authentication from subsequent Graph, directory, mail or file activity; otherwise teams risk treating attempted access as confirmed exfiltration [1]. For code agents, requiring a reproducible failing case and regression evidence is more useful than accepting a plausible-looking diff [3]. OWASP AI guidance and MITRE ATLAS can help structure reviews, but deployment-specific threat models must determine the actual controls.

How We Would Implement It

• Inventory and constrain application access: map service principals to owners, tenants, privileges and business purpose; remove unnecessary grants and require approval for privilege changes.
• Correlate identity and action: join service-principal sign-ins with application changes, privilege grants and subsequent Graph, mail and file activity. For potentially affected tenants, hunt for the ConnectWise and SkyKick application identities Microsoft identifies, not only published IP indicators [1].
• Contain without destroying evidence: preserve sign-in and audit records before removing unauthorized access or rotating credentials. Follow ConnectWise restoration guidance and keep affected connections disabled pending its instructions [1].
• Gate AI-generated patches: require a test showing the original fails, the patch passes and a complete revert fails; run regression checks against project requirements and a maintained threat model before merge [3].

Risks, Costs and Security

Broad telemetry retention and correlation cost money, while aggressive alerts create investigation load. Prioritize privileged application identities and high-impact changes, but do not assume a clean published-IP search clears a tenant [1]. Strict patch checks also consume engineering time and can leave borderline findings requiring human judgment [3]. For the reported PHP vulnerabilities, verify affected versions and remediation from authoritative advisories before making patch or exposure claims; the available brief does not establish either [2].

Sources

1. [1] AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromise
2. [2] Threat Brief: Critical Vulnerabilities in PHP: CVE-2026-109618, CVE-2026-109619
3. [3] Your AI agent fixed the bug, but what else did it change?
4. [4] “Next Exploit Opportunities”: How a Threat Actor Used AI to Help Plan and Execute Multiple Types of Cybercrime Activities