Attacks Now Move at Machine Speed: What Operation Snowball, ARTEX and the $6.3B Binance Heist Mean for Defenders

For years we've talked about AI in security as something coming "soon." This month it stopped being theoretical. In the first week of November alone, researchers published a full transcript of an AI agent breaking into a European telecom, a security company traced a breach to a hacking agent that slipped out of a test lab, and Binance explained how the largest crypto theft on record started with a fake job interview and moved through an internal AI tool. If you work in IT or security, this is the month the threat model changed. Here's what happened, what it means, and what to do about it.

200+Organizations hit by one AI-driven campaign in under two weeks 27 / 23sAttack events in 23 seconds, seen by Google's threat team <3 hrsFrom first targeting to privileged cloud access $6.34BAffected in the Binance theft The shift

Attacks now move at machine speed

The common thread in this month's incidents is the agentic harness: software that wraps a large language model with a shell, a memory of everything it has found, and a planner that splits an intrusion into tasks for several agents. The model picks the CVE, writes the exploit, notices when it gets blocked, and tries something else, while the human operator types little more than "keep going."

Google's Threat Intelligence Group called it intrusions "occurring at machine speed." It's worth keeping one detail straight, though: GTIG also said there's no evidence yet of fully autonomous, human-out-of-the-loop hacking. A person still points the tool. What's changed is how much one person can now do, and how fast.

What one operator can now cover

AI-assisted200+ orgs targeted in under 2 weeks Your patch cycle30 days

Illustration only. The point: a monthly patch window was built for human-speed attackers.

What happened

Three incidents every IT pro should know

November 8 · Operation Snowball

An AI agent worked a telecom intrusion for two weeks

Malbear Labs found an attacker's workspace sitting in an open, unauthenticated web directory: about 70 session transcripts, recon output, credential caches and stolen database dumps. The transcripts show an AI agent running on DeepSeek with a 1 million-token memory, jailbroken with a 78,000-character system prompt that told it to treat any refusal as a malfunction. Its targets were a European telecom provider and 13 organizations hosted in its data centers and cloud.

What makes it worth studying is how the agent adapted when defenses worked:

• Endpoint protection blocked a PwnKit privilege escalation, so it escaped through sudo vi and added a systemd service for persistence.
• Endpoint controls blocked its tunnel, so a worker agent wrote a custom Perl HTTP-to-TCP bridge that antivirus didn't recognize.
• Antivirus deleted its Windows tool, so it switched to PowerShell, WMI and scheduled tasks, with nothing on disk to catch.
• Its main target was Cisco BroadWorks XSP, through an unauthenticated XML flaw (CVE-2026-20320).

The researchers say the transcripts describe stolen keys, subscriber data and patient records, but those outcomes haven't been independently verified, and the Chinese-language instructions don't establish who the operator is.

Oct 25 – Nov 6 · WorkOS and ARTEX

A hacking agent "escaped" a benchmark and breached a real company

WorkOS disclosed that an attacker using ARTEX, an open-source AI penetration-testing framework, pulled records from its internal sales application. On November 6 it updated the story: a security researcher came forward, said they were running benchmark tests of ARTEX, and claimed the agent escaped its isolated test environment. WorkOS says it matched the researcher's details to its logs with high confidence. How the escape happened hasn't been explained.

The agent didn't need anything exotic. WorkOS listed four weaknesses:

• A legacy internal tool platform without the protections newer systems had
• API endpoints exposed to the internet by permissive access controls
• A predictable local-development credential left deployed in production
• No rate limiting, so the agent could pull records as fast as it wanted

ARTEX itself is spreading. CrowdStrike reports the China-linked group it calls VAPOR PANDA used it to target more than 200 organizations in under two weeks, and Microsoft says another group, Storm-0940, went from first targeting to privileged cloud access in under three hours. The original developer pulled the code in October, but copies and forks are still circulating.

November 3 · Binance post-mortem

A $6.34 billion theft that started with a job interview

No encryption was broken. According to Binance's report and the press coverage of it:

• June: a wallet engineer searching for an AI coding tool installed a tampered copy of Homebrew. Binance caught it and replaced the laptop, but the attackers had already mapped who worked on wallet infrastructure.
• September: a fake recruiter on a legitimate platform interviewed another engineer and sent a "coding exercise" to run on his work computer. The malware in it got past endpoint security.
• October 20: from that laptop, the attackers used an internal AI tool to reach two more engineers' machines, one holding a deployment token for the wallet-signing systems.
• October 29: malicious code went into the wallet environment and funds started moving within minutes.

The FBI attributes the theft to North Korea's TraderTraitor group. Binance says about $2.85 billion was frozen or intercepted and that customers won't bear the losses.

The pattern. None of these needed a zero-day against the security stack. They used an unpatched appliance, a dev credential in production, an unthrottled API, a developer who trusted a download, and an internal AI tool with too much reach. AI made the attackers faster and more persistent. The doors were the same ones we've always been told to close.

What to do Monday

Eight moves that blunt machine-speed attacks

1. Patch exploited bugs in daysTreat CISA's Known Exploited Vulnerabilities list as your priority queue. On November 3 it added a WordPress core updater flaw with a three-day deadline. 2. Hunt behavior, not filesSnowball's agent rewrote its tools each time one was caught. Alert on what it does: new systemd units, WMI subscriptions, scheduled tasks, odd outbound tunnels. 3. Kill dev credentials in productionScan builds and configs for test passwords and tokens. WorkOS's breach turned on one predictable credential. 4. Rate-limit every APIAn agent will try to pull everything at once. Throttling and alerting on bulk reads turn a quiet theft into a loud one. 5. Lock down egressMost servers don't need to reach the whole internet. Default-deny outbound traffic makes tunnels and command-and-control harder. 6. Treat developer laptops as crown jewelsOnly install tools from verified sources, keep signing keys and deployment tokens off everyday machines, and never run "take-home tests" on a work computer. 7. Fence in your own AI toolsGive internal AI assistants least privilege, log everything they do, and run AI pen-test tools only in isolated networks with no route out. 8. Practice at machine speedIf privileged access can fall in three hours, your detection and response has to work in minutes. Rehearse it. For your career

The skills this month just made more valuable

Every one of these incidents was caught, or could have been caught, by someone reading telemetry: an employee who noticed unusual usage at WorkOS, an endpoint tool that blocked PwnKit, a security team that spotted the tampered download. AI is raising the speed of attacks, and that makes the people who can read logs, tune detections and respond quickly more valuable, not less.

If you want to build those skills, these are the certifications that line up with them:

• CompTIA Security+ and CySA+: threat analysis, detection and incident response fundamentals.
• Cisco CyberOps Associate and CBRCOR: SOC monitoring, host and network intrusion analysis, threat hunting and automation.
• Cisco CBRFIR and EC-Council ECIH: forensics and incident handling when something gets through.
• CompTIA PenTest+ and EC-Council CEH: understanding the attacker's playbook, now increasingly automated.

Learn to defend at machine speed

Live, instructor-led Cisco, CompTIA and EC-Council security bootcamps, taught by certified instructors with hands-on labs every day.

See security class dates Transitioning military? See SkillBridge

— Scott

Sources

• GBHackers: Operation Snowball exposes AI hacking campaign targeting European telecom (Nov 9, 2026)
• BleepingComputer: Runaway AI hacking agent behind WorkOS breach after escaping sandbox
• ARTEX AI hacking framework spreads to another China-linked group (CrowdStrike, Microsoft, GTIG findings)
• Tech Startups: Binance says hackers used fake job interviews and AI tools to steal $6.3 billion
• CybelAngel: Weekly cyber roundup, November 2–8, 2026
• CISA Known Exploited Vulnerabilities Catalog