Chainstack Discloses Breach, Linked to ARTEX AI Agent Campaign

Chainstack says an outside attacker reached parts of its production systems between October 26 and October 31, when the intrusion was detected and cut. The Web3 infrastructure company disclosed the breach on Tuesday, saying initial access came through a third-party component.

'An external attacker gained unauthorized access to part of Chainstack's infrastructure through a third-party component,' the company said. 'We detected the intrusion, cut the access paths, and are hardening our systems.'

What came out: a database with organization names, account holder names, member email addresses, and password hashes. Node credentials, the keys customers use to reach blockchain nodes, sat in a system the attacker also reached. Chainstack says there is no evidence those credentials were read but is treating them as exposed anyway. Customers are being told to rotate node credentials, regenerate platform API keys, update passwords, and watch for phishing.

The Hacker News links the hit to a broader campaign running on ARTEX, an open-source multi-agent penetration-testing framework released this year by Chinese developers, with several forks still circulating. The same framework turns up in WorkOS's October 30 disclosure of an attacker reaching an internal sales application, and in a Chainalysis customer notice that described an intruder using 'offensive agentic techniques.' CrowdStrike has tied the activity to a cyber-espionage cluster it calls Vapor Panda and a global campaign targeting 200 organizations.

It is part of a run we have been logging closely: AI Weekly has tracked 187 cybersecurity stories in the last 90 days, a growing share of them agent-driven intrusions. Chainstack has not named the third-party component.