Back to Blog
    October 25, 20263 min read

    By Brian Hanson

    Fix Your Digital Locks Before AI Agents Pick Them

    TL;DR

    Hackers are using AI frameworks like ARTEX to attempt 3,000 logins per minute. To protect your business, move beyond text-based MFA to hardware keys and strictly limit the permissions of third-party apps connected to your data.

    Key Takeaways

    • AI agents allow hackers to attack 2,250 companies at a rate of 3,000 attempts per minute.
    • Standard text-message MFA is vulnerable to automated AI phishing.
    • Third-party cloud backups and integrations are primary targets for credential theft.
    • Hardware security keys and conditional access rules are the best defense against high-speed attacks.
    A split-screen illustration. On the left, a swarm of digital keys and code fragments fly toward a glowing padlock icon on a server screen. On the right, a physical hardware security key with circuit patterns is plugged into a laptop's USB port.

    The ConnectWise breach proves hacking now moves past human speed. Chinese hackers spied on thousands of companies after breaching IT giant ConnectWise, using AI agents to attack 2,250 organizations. These attacks hit at a rate of 3,000 sign-in attempts every minute, according to the same TechCrunch report. This is an automated system, specifically the ARTEX framework, working through credentials faster than any IT team can block.

    Hackers use AI agents to find tiny cracks in software links, like those used for cloud backups. If you rely on old security habits, you're trying to win a drag race on a bicycle. You need to wire up automated defenses that match the speed of the attack.

    Lock the Front Door with Phishing-Resistant MFA

    The ConnectWise hackers stole credentials to log into environments as authorized users. Standard Multi-Factor Authentication (MFA), where you get a text code, is no longer enough. AI agents can automate the process of tricking employees into giving up those codes.

    Switch to hardware keys, like YubiKeys, or passkeys. These require a physical touch or biometric scan on a specific device. An AI agent in another country cannot physically touch a USB key plugged into your laptop. This one step stops most automated sign-in attacks cold.

    Audit Your Third-Party Links

    This breach happened because of a link between a service provider and its customers. You likely have several apps connected to your main business accounts. These are integrations, which is just software that talks to other software. If one app is breached, the hacker can use that trusted link to reach your data.

    Review your integrations today. Strip back any app permissions that aren't strictly necessary. If an old project management tool still has access to your company email or cloud storage, disconnect it. Less surface area means fewer targets for an AI agent to scan.

    Monitor for Impossible Speed

    Humans don't try to log in 3,000 times a minute. You should turn on Conditional Access policies if your software allows it. These are rules that block login attempts from outside your country or block accounts that show impossible travel, such as logging in from New York and London within 10 minutes.

    Let the software do the watching. You cannot outrun an AI agent, so you must stack your defenses to trip them up automatically. Check your MFA settings right now to see if you can move away from text-based codes.