Microsoft researchers say China state-aligned hackers broke into ConnectWise‘s cloud backup service and stole application credentials used to establish data links between ConnectWise and its corporate customers. With those credentials, the attackers could sign in to customers’ Microsoft-hosted environments as authorized users and access emails and other files.

The rapid mass-hacks were attributed to AI agents, specifically ARTEX, an open-source AI framework that works with AI models to stress-test cyber defenses. Microsoft says the attackers used these agents to compromise around 2,250 organizations at a rate of almost 3,000 attempted sign-ins per minute, leaving defenders “little time to detect and respond.” The same AI software was used in a recent compromise of South Korea’s financial systems, many of which had weak security and lacked multi-factor authentication.

ConnectWise has paused access to its cloud backup system while investigating the breach. As of Thursday, the company said it was working to restore the service.