Canada’s Cyber Security Centre Warns Agentic AI Is Accelerating Attacks on an Industrial Scale
The Canadian Centre for Cyber Security has issued an advisory warning that agentic AI is accelerating cyberattacks globally, citing a Chinese state-aligned group called Storm-0940 that used an automated penetration testing system to compromise organizations in under three hours.
The Canadian Centre for Cyber Security has warned that agentic artificial intelligence is accelerating cyberthreats on an industrial scale, pointing to the activities of a Chinese state-aligned threat actor known as Storm-0940. According to an advisory issued by the agency, the group has used agentic AI to automate attacks against hundreds of organizations worldwide.
Microsoft reported that Storm-0940 has been deploying an agentic penetration testing system called ARTEX since at least September. The tool enabled the group to target organizations across multiple sectors, including financial services, manufacturing, defence, automotive, media, and technology. In some cases, the automated attacks resulted in compromised cloud infrastructure in less than three hours.
Rajiv Gupta, head of the Canadian Centre for Cyber Security, noted that AI is now being used across different elements of the cyber kill chain. This rapid automation is increasing pressure on organizations to make security decisions within minutes rather than days.
The advisory also highlighted broader vulnerabilities in the global digital landscape. Last week, security researchers disclosed critical vulnerabilities in PHP, which led to many government websites around the world going temporarily offline.
Despite the growing role of AI in offensive operations, the agency advised that fundamental cybersecurity practices remain critical. Weakly protected accounts, excessive access privileges, exposed systems, unpatched software, and monitoring gaps continue to serve as common entry points for attackers.