Hackers Used an AI Agent This Week. So Did Everyone Else.

Nobody on the vendor side slowed down to notice.

That's the split running through this week's signal: an AI agent showed up on the attacker's side of the ledger for the first time at this scale, and the defenders' response was to keep shipping agents more authority anyway. Microsoft disclosed that Storm-0940, a China state-aligned group, used an open-source AI pentesting framework called ARTEX to hit Microsoft 365 tenants at nearly 3,000 sign-in attempts a minute through a breached ConnectWise service. Railway told every one of its customers to rotate their keys after a second dev-platform breach this week, following OpenCode's disclosure days earlier. Meanwhile Walmart opened a shopping gateway built for agents, AWS let agents log into real desktops without a password, and Shopify's own coding agent now writes most of the company's merged mobile code. If you run a business on rented infrastructure — which is every SMB — this was the week the agent story stopped being one-sided.

Models + launches

OpenAI's Terminal X case study put a real number on something that's usually a vibe: can an AI agent actually match professional judgment, not just sound like it can. Running on GPT-6.1 Sol, Terminal X's eval agent graded 500 real investment decisions against a 54-criterion rubric and landed the same verdict as a senior human reviewer 88.6% of the time — beating the next-best model's 86.4% — while catching about 25% more recommendations that strayed from a fund's mandate, at roughly 30% lower cost per query [1]. It's vendor-reported, not an independent audit, so treat the exact numbers as a ceiling, not gospel. But the framing is the useful part: this isn't "AI picks better trades," it's "AI checks the humans' work against the rules more consistently than the last reviewer did." That's the agent use case that survives contact with a compliance team.

Tooling shifts

Amazon WorkSpaces now lets AI agents open a desktop session through OAuth 2.0 instead of a static password — the agent authenticates with your existing AWS credentials, and the service handles connecting, holding, and tearing down the session itself [2]. That's the boring-sounding fix for a real problem: if you've ever handed an agent a desktop login to operate some legacy app that has no API, you know the alternative was "give it your password and hope." OAuth-scoped, time-limited sessions aren't a complete audit trail on their own, but they're the first real step away from treating agent access like a shared office password.

Shopify's engineering team published the clearest "why isn't my coding agent actually shipping more" answer I've read this week — and the fix wasn't a smarter model. Their River agent initially wrote just 6% of Shopify's merged mobile pull requests, bottlenecked by compile-and-check cycles that took 30-plus minutes per run. Setup time dropped to a few minutes, and River's share of merged mobile PRs jumped to 61% [3].

Source: Shopify Engineering — Remote Dev

The lesson transfers directly: if your Claude Code or Cursor agent feels slower than it should on a real codebase, the model usually isn't the bottleneck. The thirty seconds of environment setup you make it redo every single run is.

SMB angles

Microsoft's own disclosure is the one worth sitting with longest. Storm-0940 broke into ConnectWise's cloud backup service, stole application credentials, and then used them to access customers' Microsoft-hosted environments as if logging in normally — no password-guessing alarm triggers, because the hackers already had the keys a trusted vendor handed them [4]. What made this attack different from the usual nation-state slog: ARTEX, the AI agent running the operation, pushed sign-in attempts at close to 3,000 a minute across more than 2,250 tenants. If your MSP or backup vendor runs ConnectWise, that speed is the entire point — automated credential abuse at that pace outruns what most incident-response plans budget for "detect."

Railway had its own bad week, disclosing that attackers accessed encrypted environment variables and, for some customers, the decrypted contents underneath — then telling every user to rotate keys regardless of whether they were in the confirmed-affected subset [5]. Railway's advisory pointed at a broader pattern: attacks aimed at AI inference providers, using malicious prompts to coax secrets out of AI systems rather than brute-forcing a database. This is the same week OpenCode disclosed hackers got more than 1% of its customers' API keys and secrets. Two dev-platform breaches, one week, both touching the infrastructure agent-based tooling runs on.

Against that backdrop, Walmart's news reads almost cheerful: it opened an Agent Gateway built on MCP — the protocol Anthropic created — letting approved AI agents buy on Walmart.com and Sam's Club on a shopper's behalf [6]. Agent Profiles, landing in November, let a customer see an agent's purchases separately from their own and either approve each transaction or set a spending cap. Amazon took the opposite bet the same week, moving to block AI agents from buying on its site entirely. One retailer is building the rails for agent commerce; the other is pulling up the drawbridge. Pick your assumption about which one looks right in a year, but notice that neither posture is actually "wait and see."

Adjacent to watch

Meta paused Muse's chat-sharing feature after security researchers at Claroc found roughly 6,800 shared conversation links sitting exposed with no login required — including a bank-fraud alert, a small-business loan application, and internal revenue reviews [7]. The mechanism is almost funny in how avoidable it was: Muse built each share link from the conversation's own title plus a random string, published under a shared domain, which meant the titles themselves — "loan-application-draft," "q3-revenue-review" — ended up sitting in public DNS records where anyone running a passive lookup could enumerate them. Claroc reported it October 8th; Meta didn't pause the feature until Ars Technica asked about it. Treat any "share this chat" button on a consumer AI tool as public-by-default until the vendor proves otherwise — and if you're naming your own internal documents, titles are data too.

The attackers didn't need a zero-day. They needed an agent that doesn't get tired at nearly 3,000 sign-in attempts a minute.

Put this week's attacker-side story next to the vendor-side rollout and the shape gets obvious:

flowchart TD
  Start([This week's signal]) --> Offense[An agent broke in]
  Start --> Rollout[Agents got handed more authority anyway]
  Offense --> O1["Storm-0940 + ARTEX:<br/>2,250 orgs, ~3,000<br/>sign-ins/min"]
  Offense --> O2["Railway: secrets decrypted,<br/>follows OpenCode breach<br/>same week"]
  Rollout --> R1["Walmart: Agent Gateway,<br/>agents buy on your behalf"]
  Rollout --> R2["AWS: WorkSpaces agents<br/>OAuth into real desktops"]
  Rollout --> R3["Shopify: River writes<br/>61% of merged mobile PRs"]
  O1 --> Verdict[[Nobody paused to match<br/>the rollout to the threat]]
  O2 --> Verdict
  R1 --> Verdict
  R2 --> Verdict
  R3 --> Verdict

None of this means pause your own agent rollout until some industry body finishes a framework — Storm-0940 didn't wait for permission either. It means the same thing this signal says most weeks: know exactly what credentials your vendors hold on your behalf, know what an agent operating under your name can actually do, and write both down before a breach or a changelog entry decides it for you. That's the first thing I check in any agentic automation engagement — not "does the agent work," but "what does it touch, and who notices the day it's wrong." It's the same question that mattered when I moved 200+ client accounts for Palmer's Financial with zero downtime: the migration tooling wasn't the risk. The unaudited access path was. If this week's ConnectWise and Railway breaches sound familiar, they're the same failure mode I wrote up when 16,326 Supabase databases leaked — a default nobody checked, not a sophisticated hack.

Sources

[1] OpenAI — Terminal X matches senior investor judgment 88.6% with GPT-6.1 — openai.com [2] AWS — Amazon WorkSpaces: AI agent connection management via OAuth — aws.amazon.com [3] Shopify Engineering — Remote Dev — shopify.engineering [4] TechCrunch — Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise — techcrunch.com [5] TechCrunch — Developer platform Railway urges all users to revoke secret keys after cyberattack — techcrunch.com [6] TechCrunch — While Amazon blocks AI agents, Walmart rolls out the welcome mat — techcrunch.com [7] Ars Technica — Meta Muse exposes users' personal and business secrets when they share conversations — arstechnica.com

The short version

• China-linked hackers (Storm-0940) used an open-source AI pentesting agent, ARTEX, to breach ConnectWise's cloud backup service
• Railway told every customer to rotate API keys after attackers decrypted stored secrets — the second dev-platform breach disclosed this week, after OpenCode
• Walmart opened an MCP-based Agent Gateway letting agents buy on a shopper's behalf under a spending cap, directly contrasting Amazon's new stance of blocking agent purchases outright
• AWS WorkSpaces now lets agents authenticate into real desktop sessions via OAuth instead of a static password
• Shopify's River coding agent now writes 61% of the company's merged mobile pull requests, up from 6% — the fix was removing setup friction, not a smarter model
• Meta paused Muse's chat-sharing feature after researchers found 6,800 links enumerable via public DNS — but only after Ars Technica asked
• OpenAI's Terminal X eval agent matched a senior investor's judgment 88.6% of the time across 500 real decisions, catching 25% more mandate deviations than the prior review process