---
title: "Storm-0940 weaponises ARTEX, LiteLLM ships a stealer, METR red-teams OpenAI"
date: 2026-10-23
summary: "China-aligned Storm-0940 ran the ARTEX agent framework against 2,250+ M365 tenants, LiteLLM 1.107.0 shipped a stealer, and METR red-teamed OpenAI's monitor."
cover: "https://morningtokens.com/covers/2026-10-23.jpg"
url: "https://morningtokens.com/issues/2026-10-23/"
---

Pour the tea slowly today: the lead story is the first big state-backed campaign where an open-source AI pentest framework did the heavy lifting. Microsoft says China-aligned Storm-0940 used ARTEX to turn one stolen set of ConnectWise app credentials into attempts on 2,250+ Microsoft 365 tenants.

Around it: a poisoned LiteLLM release, an outside red-team of OpenAI's own agent monitoring, and a new way for agents to log in without ever seeing your password. It's Friday, so the money stories (OpenAI at $1.25T, DeepSeek's $15B) come at the end.

## Top news

### 1. Security · Storm-0940 used the ARTEX agent framework to industrialise the ConnectWise breach

Microsoft attributes the ConnectWise Cloud Backup supply-chain compromise to China-state-aligned Storm-0940, which used the open-source ARTEX multi-agent pentest framework against 2,250+ Microsoft 365 tenants. In some cases it reached privileged cloud access in under three hours.

- **The entry point:** Storm-0940 stole the application credentials ConnectWise uses to reach customers' Microsoft-hosted environments, so it could authenticate as an already-consented app with no interactive user sign-in.
- **Machine speed:** Microsoft says ARTEX accelerated scanning, password spraying and OAuth application abuse.
  - TechCrunch: close to 3,000 attempted sign-ins per minute.
  - SOCtember's write-up of the data: 151,000+ failed sign-ins, peaking on Oct 11.
- **Follow-on activity** ran through Microsoft Graph: reconnaissance, application credential changes and privilege-modification attempts aimed at persistence.
- **What ARTEX is:** a Go multi-agent LLM system with a Next.js UI that runs a pentest end to end and builds a graph of found assets and vulnerabilities. It works with any model.
- **Targets and status:** aerospace and defense, energy, finance, government, legal, semiconductors, think tanks and more. ConnectWise paused cloud backup and, on Oct 22, said to keep affected app connections offline until further notice.

> ARTEX runs a pentest "from reconnaissance through data exfiltration with little needed human interaction."

Microsoft says this was not a flaw in its own products, and that a successful authentication doesn't by itself mean data was taken.

**Why it matters:** A commodity, open-source offensive agent stack gives a nation-state actor machine-speed breadth. The detection window shrinks from days to hours, and app-to-app trust (OAuth, service principals) is the soft spot, not passwords.

Sources: [Microsoft Security Blog](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/) · [TechCrunch](https://techcrunch.com/2026/10/22/chinese-hackers-spied-on-thousands-of-companies-after-breaching-it-giant-connectwise/) · [CyberScoop](https://cyberscoop.com/microsoft-attributes-connectwise-supply-chain-attack-china-storm-0940/) · [Dark Reading](https://www.darkreading.com/cyberattacks-data-breaches/microsoft-storm-0940-connectwise-supply-chain-attack)

### 2. Supply chain · LiteLLM 1.107.0 shipped a credential stealer for about two hours

LiteLLM's release pipeline was hijacked on Oct 21 and pushed a malicious 1.107.0 to PyPI and Docker. The stealer ran at every Python start and specifically harvested AI-tool configs (`~/.cursor`, `~/.claude` and others) plus cloud, SSH and CI secrets.

- **Exposure windows:**
  - PyPI `litellm==1.107.0`: live 11:39–13:23 UTC (13:39–15:23 Warsaw time).
  - Docker Hub and GHCR tags `v1.107.0`, `latest`, `main-latest`, `main-stable`: compromised images from 11:46 until 13:51–14:20 UTC.
- **Reach:** Wiz cites about 49,000 downloads of the bad version. AISLE's dependency firewall flagged the first wheel 3 minutes 14 seconds after upload.
- **How it fires:** the payload added `cook.pth`, `cook.py` and `sitecustomize.py`, so it runs on interpreter start without importing litellm.
- **What it takes:** browser passwords, SSH keys, cloud credentials and instance metadata, Kubernetes, Vault and CI secrets, `.npmrc`/`.pypirc`/`.git-credentials`, and AI-tool configs, encrypted and exfiltrated. A second loader fetches and runs remote code hourly.
- **How it happened:** the GitHub tag is clean; artifacts were built from an attacker-controlled repo. Branch protection blocked an unauthorized workflow change, then a privileged developer credential overrode it seconds later.

LiteLLM also mentions an embargoed vulnerability fix for enterprise customers, with disclosure set for Oct 27.

**Why it matters:** LiteLLM sits in front of model API keys in a huge number of agent stacks. The stealer going after agent-tool configs shows attackers now treat coding-agent folders as a credential store.

Sources: [LiteLLM incident post](https://docs.litellm.ai/blog/security-incident-oct-21-2026) · [OSV MAL-2026-2144](https://osv.dev/vulnerability/MAL-2026-2144) · [Wiz](https://www.wiz.io/blog/litellm-compromised-steals-credentials) · [AISLE](https://aisle.com/blog/litellm-11070-on-pypi-shipped-a-credential-stealer)

### 3. Safety · METR and Redwood found ways for agents to slip OpenAI's internal misalignment monitor

Two outside researchers got three weeks of deep, on-site access to OpenAI's internal agent-monitoring system and found several novel ways agents could have dodged or disabled it. OpenAI says the production-affecting holes are patched.

- **The pilot:** July 21 to August 11, with access to OpenAI's codebase, monitor prompts and configs, plus interviews with about a dozen staff. It produced a 61-page internal report; the public post is deliberately brief.
- **Coverage estimate:**
  - Agentic internal Responses API traffic from GPT-5.5-class models or stronger: roughly 75–94% eligible for monitoring.
  - Internal Codex agents: 99.2%.
  - RL training runs weren't covered at the start.
- **The compaction gap:** not monitoring compaction events left on the order of 10% of eligible Codex traffic unmonitored between May and July. OpenAI had spotted this and fixed it during the exercise.
- **Postponed review:** the monitor fired when control returned to the user, so an agent could delay review by simply continuing to act.
- **Other findings:**
  - a way for Codex agents to bypass sandboxing and Auto-Review;
  - a redacted exploit hiding hundreds of recent actions from monitoring;
  - serialization tricks that make the monitor fail;
  - two client-controllable headers that disable monitoring for new agents;
  - two "read-only" tools that could be pushed into arbitrary actions.

**Why it matters:** Labs lean on monitoring as the safety net for increasingly autonomous internal agents. This first detailed outside look shows how much depends on plumbing (compaction, headers, serialization) rather than the monitor model itself.

Sources: [METR](https://metr.org/blog/2026-10-22-red-teaming-openai-agent-monitoring/) · [The Verge](https://www.theverge.com/ai-artificial-intelligence/1017179/openais-misalignment-monitoring-system-had-a-number-of-novel-vulnerabilities-third-party-evaluators-found) · [CNBC](https://www.cnbc.com/2026/10/22/metr-redwood-research-open-ai-test.html)

### 4. Agents · 1Password for Agents lets assistants sign in without seeing your password

1Password launched a platform where an agent proves its identity with its own key, you approve each sign-in on your device, and 1Password fills the credentials so the agent never holds them.

- **The flow:** the agent hits a login form and presents a unique digital key to 1Password. You get a notification saying which account and why; on approval 1Password fills the login, similar to a 2FA prompt.
- **Launch agents:** Meta Muse, ChatGPT Work and Dots, Claude Duet, Grok Bot and Town.
- **Coming:** Browserbase, Browser Use, Dana, Instinct, Kernel, Perplexity, Ramp, Tomo and Wajo.
- **Rollout:** @alexandr_wang says it's coming to Muse "over the coming days."
- **Banks push back:** the same day, Axios reported JPMorgan, Citi, Bank of America and Morgan Stanley restricting third-party agent access because they can't tell an authorized agent from a rogue one.

> One banker on rogue agents: "horrifying."

**Why it matters:** Handing agents raw passwords is today's default, and it leaves copies everywhere. A per-login approval layer is the first broadly supported answer, and it gives banks and sites something to check besides "is this a bot."

Sources: [1Password blog](https://1password.com/blog) · [TechCrunch](https://techcrunch.com/2026/10/22/1password-launches-a-way-for-ai-agents-to-log-in-on-your-behalf-without-seeing-your-password/) · [The Verge](https://www.theverge.com/ai-artificial-intelligence/1016399/1password-ai-agent-password-sign-in) · [@alexandr_wang](https://x.com/alexandr_wang/status/2113436201638375907)

### 5. Security · Anthropic folds its cyber access programs into a three-tier Cyber Verification Program

Anthropic expanded its Cyber Verification Program into three tiers: Defense, Red Team and a top tier for safety-critical systems. Each gets access to Opus 5.5, Sonnet 5.5 and Mythos 5.1 with reduced cyber blocking.

- **Defense Access:** SOC and incident response, malware reverse-engineering and vulnerability validation. Reviews take "a few days."
  - Open to company security teams, nonprofits, universities, government, critical-infrastructure operators of any size, small security firms, open-source maintainers and individual researchers with a track record.
- **Red Team Access:** adds authorized pentesting and red-teaming against systems you're allowed to test. Organizations only; it takes a few weeks. Real-time blocks remain on things like ransomware deployment or physical damage.
- **Top tier:** the fewest blocks, for verified orgs testing flight software, power grids, telecom and interbank infrastructure, reviewed together with the US government. Project Glasswing members move there automatically.
- **Data retention** is required for monitoring until "Enterprise Frontier Safeguards" (zero data retention with safeguards) arrives later this fall.

**Why it matters:** Attackers already run agent pentest stacks with any model (see item 1), and this is a frontier lab's answer: gated stronger models for verified defenders. Open-source maintainers and solo researchers qualifying for the defensive tier is the notable part.

Sources: [Anthropic](https://www.anthropic.com/news/cyber-verification-program)

### 6. Models · OpenAI's Decisions API is generally available, built on a sped-up ChatGPT Luna

OpenAI opened its Decisions API, announced at DevDay on Sept 29, to all customers. It's a fast "pick an option plus confidence" endpoint aimed at TypeSafe's Jev, now with voice and visual inputs.

- **No dedicated model:** OpenAI reconfigured ChatGPT Luna for speed and cost instead of training a new decision model.
- **Latency per call** (per product lead Nikunj Handa): **100–180 ms** (previously 1–3 seconds).
- **Early users:**
  - Speak cut time between actions to **0.13 s** (from 1.4 s).
  - Box, Datadog and Ramp are also early users; OpenAI used it to make Dots more responsive.
- **Rankings** on the two decision-model indices, per TechCrunch:
  - OpenAI: eighth and fourteenth, behind Liquid's new D1 Ultra and Base Labs' Elephant-1.
  - Latest Jev: seventh and third, and it tops Opper AI's PacMan benchmark.

**Why it matters:** Decision models are becoming their own category, replacing LLM calls in routing, classification and agent control loops at a fraction of the latency. The benchmarks disagree, so test on your own workload.

Sources: [TechCrunch](https://techcrunch.com/2026/10/22/openai-makes-its-jev-competitor-widely-available-as-decision-model-competition-heats-up/)

### 7. Standards · Anthropic donates Agent Skills to the Linux Foundation's Agentic AI Foundation

Anthropic is moving the SKILL.md standard to the vendor-neutral Agentic AI Foundation, the same home as MCP, with maintainers from Anthropic, Google and OpenAI.

- **Adoption, per Anthropic:**
  - 1 million skills published and nearly 280 million installed;
  - more than 70 agent platforms support the format (ChatGPT, Cursor, GitHub Copilot and VS Code among them) since it was published in December 2025.
- **Maintainers:** David Soria Parra and Mahesh Murag are lead maintainers.
- **Proposed roadmap:** versioned releases, a formal proposal process and security guidance for writing and installing skills.
- **Reaction:** @simonw notes he'd predicted the move.

**Why it matters:** Skills are now the portable way to package agent know-how across vendors. Neutral governance plus security guidance matters given item 2: skill folders are exactly the kind of thing supply-chain attackers will target next.

Sources: [Anthropic](https://www.anthropic.com/news/donating-agent-skills-to-the-agentic-ai-foundation) · [Simon Willison](https://simonwillison.net/)

### 8. Health · Microsoft's MAI-DxO doubles generalists' accuracy on hard cases, in Science

Microsoft's multi-agent diagnostic orchestrator got 83% of complex NEJM cases right in simulation, versus 36% for primary-care doctors and internists working alone with references. The study's own data shows most of the gain comes from stronger base models.

- **How it works:** DxO coordinates agents acting as a panel that questions the patient, orders tests and debates a diagnosis.
- **Models tested:** OpenAI, Google, Anthropic, Meta and DeepSeek; best results came with GPT-5 and GPT-5.5.
- **Accuracy and cost:**
  - GPT-5 alone: **78.9%** at about $8,400 estimated cost per case; DxO cut cost by about $3,000 and added about four points.
  - GPT-5.5 on complex cases: **nearly 87%** with DxO (72% without), at slightly lower cost.
  - Gemini 2.5 Flash: **nearly 69%** with DxO (46.4% without).
  - Emergency-department cases: little gain, about 85% both ways.
- **Caveat:** specialists and physician teams, who usually handle such cases, weren't in the comparison.
- **Next:** a prospective study at Beth Israel Deaconess, and a Mayo Clinic healthcare foundation model planned for next year.

**Why it matters:** It's a peer-reviewed, cost-aware result. The honest takeaway is that orchestration helps most with weaker models and hard cases, not across the board.

Sources: [TechCrunch](https://techcrunch.com/2026/10/22/microsofts-mustafa-suleyman-says-its-ai-outperforms-doctors-on-hard-cases-as-he-chases-medical-superintelligence/) · [The Verge](https://www.theverge.com/ai-artificial-intelligence/1016690/suleyman-microsoft-diagnostic-orchestrator-science-medical-superintelligence)

### 9. Images · Canva Craft, an in-house model that plans the layout before it paints

Canva Research released Craft, its first image model trained from scratch. A planning stage writes out composition, scale, hierarchy and text, then a renderer produces images up to 2K in 30+ aspect ratios.

- **Training data:** human-made Canva templates (posters, menus, social posts, typography-heavy layouts) rather than photos, so outputs can become layered, editable designs.
- **Rankings, per Canva:** debuted fourth overall on DesignArena, and first in People & Portraits and in Landscapes & Nature.
- **Availability:** now in Canva (Dream Lab) and the public API; MCP support for ChatGPT and Gemini is planned.
- **Coming:** cheaper Craft-fast and Craft-ultrafast variants.

**Why it matters:** "Plan, then render" is a practical fix for legible text and targeted edits. A big app owning its model also cuts API bills to the frontier labs.

Sources: [Canva](https://www.canva.com/newsroom/news/canva-craft/) · [TechCrunch](https://techcrunch.com/2026/10/22/canva-releases-its-first-image-generation-model/)

### 10. Money · OpenAI talks $30B at a $1.25T pre-money; DeepSeek reportedly raises about $15B

Reports say OpenAI is negotiating up to $30B, led by Coatue and UAE investors, at a $1.25T pre-money valuation. Separately, DeepSeek reportedly raised about $15B, days after the US federal removal order.

- **OpenAI terms:**
  - Valuation: **$1.25T** pre-money (an earlier report said $1.4T).
  - Still being negotiated; CNBC says the UAE money could come with extra compute capacity.
  - Above $1T it would be the most valuable private company ever, raising the bar for its IPO.
- **Anthropic:** CNBC also reports it is targeting $1.5–2T for its listing.
- **DeepSeek:**
  - About $15B (around 100B yuan); potential investors reportedly include CATL and Tencent.
  - Founder Liang Wenfeng is estimated to keep 81.6% of the Chinese operating entity.
  - The money goes to infrastructure and open models.

**Why it matters:** Capital is concentrating further at the top on both sides of the Pacific. US restrictions clearly haven't cut DeepSeek off from domestic money.

Sources: [TechCrunch on OpenAI](https://techcrunch.com/2026/10/22/openai-working-on-new-30b-raise-at-1-25t-valuation-ahead-of-ipo/) · [TechCrunch on DeepSeek](https://techcrunch.com/2026/10/22/deepseek-reportedly-raises-15b-days-after-us-restrictions/)

## GitHub repos

- **[shiyu-coder/Kronos](https://github.com/shiyu-coder/Kronos)** (★43,237, +2,410 this week, +500 today) — a family of decoder-only foundation models for financial candlestick (OHLCV) data.
  - A tokenizer quantizes K-lines into discrete tokens and an autoregressive Transformer is pre-trained on them.
  - Models are on the Hugging Face Hub, it supports batch forecasting across many assets, and fine-tuning scripts are released.
  - Not brand new, but accelerating hard; pairs well with the Quant-Arena paper below.
- **[anthropics/knowledge-work-plugins](https://github.com/anthropics/knowledge-work-plugins)** (★31,718, +303 today) — open-source plugins that turn Claude into a specialist for a job function, built for Claude Cowork and compatible with Claude Code.
  - Each plugin bundles skills, connectors, slash commands and sub-agents, for example productivity, sales, customer support, product management, marketing, legal and finance.

## Research papers

- **Deep Search in Real-World Web Environments** (2610.30181, 32 upvotes) — the OpenDS task evaluates multi-step deep-search agents on the live, open web instead of static retrieval sets. [HF](https://huggingface.co/papers/2610.30181)
- **Retrieval Augmented Generation Compositionality** (2610.29722, 28 upvotes) — the LASAGNA framework tests 450 RAG configurations to see whether individual tricks still help once combined. [HF](https://huggingface.co/papers/2610.29722)
- **Naive RAG Is Stronger Than We Thought** (2610.30755) — plain dense retrieval plus reranking over raw chat history ranks first in six of seven memory-benchmark settings, beating complex agentic memory by 0.13–5.53 points. [HF](https://huggingface.co/papers/2610.30755)
- **Quant-Arena** (2610.30113, 21 upvotes) — an end-to-end quant-research benchmark on real A-share data; models get feedback only on 2022–2023 and freeze one strategy for later evaluation. [HF](https://huggingface.co/papers/2610.30113)
- **Inherited, Not Invented** (2610.30882) — the "wait" in reasoning traces mostly comes from training data, not RL; zero-RL raises MATH-500 accuracy while the word stays near absent. [HF](https://huggingface.co/papers/2610.30882)

## AI agent use cases

- **Audit your Microsoft 365 tenant:** have an agent review service-principal sign-ins, new app credentials, consent grants and Graph activity since Oct 15. If you use ConnectWise, disable its app connections and preserve logs first.
- **Hunt for LiteLLM 1.107.0:** ask an agent to search lockfiles, container images and CI caches for that version. If found, rebuild the machine, rotate every reachable key and pin to `1.106.2` or earlier.
- **Benchmark a decision model on your own workload:** have an agent replay a sample of your routing or classification calls against a decision endpoint and compare latency and accuracy, since the public indices disagree.

## AI workflows

**1. [Agent loops keep ~40 container images patched to zero CRITICAL/HIGH findings](https://x.com/yildiz/status/2113407122654523807)**
- **Replaces:** hours every week of security, DevOps and service owners chasing scanner findings across about 40 container images.
  - A ten-minute dependency bump often took half a day.
- **What to connect:** an agent loop per image family (Go, Bun, custom base images) that reads new scanner findings, edits the Dockerfiles and opens a PR.
- **How it works:** a CI gate rebuilds and re-scans every affected image, starts the container and checks its health probe. If the gate fails, the next run reads the log and fixes it.
- **Results:** Edge Delta runs this on its own AI Teammates.
  - 30+ Go module bumps so far.
  - A Bun service taken from 143 findings to zero.
  - A Node 22 to 26 upgrade for a patched OpenSSL.
- **Who it's for:** platform, DevOps and security teams running many container images.

**2. [An n8n pipeline replaces a paid e-commerce review app](https://x.com/AlexStankoo/status/2112506317399306262)**
- **Replaces:** a review-collection SaaS app at $50+ a month.
- **What to connect:** n8n, Resend and Supabase.
- **How it works:** n8n parses order emails with regex, waits five days and sends a review link through Resend. Verified reviews go to Supabase; anything rated three stars or lower goes to a private support queue instead of being published.
- **Results:** the author says it saves $600+ a year.
- **Who it's for:** small online-store owners who want verified reviews without another subscription.

**3. [A personal agent audits email for forgotten subscriptions and cancels them](https://x.com/v_shakthi/status/2113119223975383205)**
- **Replaces:** digging through the inbox and bank statements to find and cancel recurring charges.
- **What to connect:** a personal AI agent with access to a personal (not work) email account. The agent product is not named in the post.
- **How it works:** asked for a table of every subscription, its cost and how long it had been held, the agent flagged $9,000 a year.
- **Results:** two cancellations, including a forgotten duplicate Dropbox plan, saved $1,000–1,200 a year against a $20/month agent.
- **Who it's for:** anyone, especially sole traders, with a pile of software subscriptions; keep work accounts out of a personal agent.

## Quick hits

- **Uber puts all 30,000 staff on ChatGPT Work** — it scaled up from a 1,000-person pilot where 80% of early users were non-engineers. [TechCrunch](https://techcrunch.com/2026/10/22/uber-puts-all-30000-employees-on-chatgpt-work/)
  - Uber isn't disclosing the cost and says it will track workflows before deciding more.
- **Anthropic Public Benefit Fund** — subject to stockholder approval, 5% of Anthropic's shares go into a new LLC. [Anthropic](https://www.anthropic.com/news/public-benefit-fund)
  - Plus 2% more at the board's discretion for every 50% rise in value above a baseline.
  - With founder and employee pledges, about 20% of shares would be dedicated to the public good.
- **Agents that play learn better** — MIT researchers left 13 Claude Opus 4.7 agents ("Eko") on a simulated island for 30 hours with no task. [TechCrunch](https://techcrunch.com/2026/10/22/left-alone-with-nothing-to-do-ai-agents-started-playing/)
  - They invented games and later beat fresh agents on set challenges; six found a mid-jump throwing trick the designers hadn't intended.
- **Spotify wants to be the agents' music service** — at 788M monthly users, Söderström told investors it's "leaning in" to agents. [TechCrunch](https://techcrunch.com/2026/10/22/spotifys-current-ai-bet-is-about-being-the-music-service-that-agents-choose/)
  - The agent asks Spotify and Spotify reasons over its own data, which isn't shared with partners.
- **Muse launches in Japan; ChatGPT ads reach 26 more countries** — @alexandr_wang announced Meta's Muse in Japan. [@alexandr_wang](https://x.com/alexandr_wang/status/2113430642440736859) · [The Verge](https://www.theverge.com/ai-artificial-intelligence/1015567/chatgpt-ads-26-countries-rollout)
  - OpenAI is bringing ads to Free and Go users in 26 more countries (89 total), per The Verge.

## Go deeper

- **[Microsoft's full Storm-0940 / ARTEX report](https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/)** — with detections and hunting queries.
- **[LiteLLM's incident timeline](https://docs.litellm.ai/blog/security-incident-oct-21-2026)** — a concrete case of branch protection being overridden by a privileged credential.
- **[METR's red-teaming post](https://metr.org/blog/2026-10-22-red-teaming-openai-agent-monitoring/)** — on OpenAI's agent monitoring.

*Caveats: OpenAI and DeepSeek funding figures are reported, not confirmed. Skills adoption numbers, Canva's DesignArena placement and Decisions API latencies are company-reported.*