Trend Watch: Attackers' Agents Are Starting to Leave Fingerprints

Three security reports published between November 2 and 3, 2026 describe AI agents on the wrong side of an incident. What they share is not a new attack technique but a new kind of evidence: the traces an agent leaves behind.

Three reports, three kinds of trace

User agents. WorkOS says that on October 30 it found unauthorised access to an internal sales application, exposing business contact details and summaries of customer communications, with no evidence that production services or application data were affected. Its bulletin says the attacker used "an AI-assisted offensive security framework to automate reconnaissance and exploitation attempts." BleepingComputer reports that founder Michael Grinich named the framework as ARTEX, citing user agent strings such as artex-enrich/1.0 and norma/0.4 in the attacker's requests.
Timing. BleepingComputer reports Bitdefender's analysis of a 3AM ransomware affiliate that encrypted about 37 of nearly 50 machines at a UK school estate in September. Bitdefender's case for an agentic loop rests on repeated commands, slightly modified at each attempt, issued at roughly regular intervals of 40 to 100 seconds. It says it could not tell which model was used, or "even whether a person was copying and pasting instructions and results between the implant and the model."
Instruction files. Check Point Research found Haiou, a Codex jailbreak bundle that also writes a persistent instruction into the agent's global instructions so that greetings trigger an advertisement for a third-party LLM gateway. It calls this "prompt adware". Check Point found no evidence that the gateway is malicious or that data was stolen. The Hacker News reports 403 stars and 77 forks for the repository since July 10.

Why this is a shift for defenders

Most AI security discussion has been about what models can do. These reports are about recognising when one is doing it. An automated loop tends to retry quickly and regularly, sends tooling identifiers it did not bother to hide, and keeps its state in files such as instruction and configuration files. On the defensive side, OpenAI's November 5 release of GPT-6 Cyber, which stresses staying within an authorised scope, shows the same tools are being built to be more controllable for defenders.

What remains uncertain. These are three reports, chosen because they share a theme, and two rest partly on the victims' or vendors' own accounts. A user agent string is trivial to change, so it identifies careless attackers, not all of them. Bitdefender itself could not rule out a human relaying commands by hand.

I think the useful response is cheap and boring. At Belgavi's Book Store, Geetha's team could add three alerts: unknown or tool-like user agents hitting the internal help-desk admin pages; bursts of nearly identical failing requests at regular intervals from one source; and any change to the instruction and skill files that shape the store's own coding agents, checked against a known hash. None of these needs an AI product. The first will stop working once attackers notice it, which is why the second and third matter more.

Sources and evidence

Between November 2 and 3, WorkOS attributed an October 30 breach of an internal sales app to the ARTEX AI pentesting framework via user agent strings, Bitdefender inferred an agentic loop in a 3AM ransomware attack on a UK school estate from commands retried every 40 to 100 seconds, and Check Point found a Codex bundle that rewrote global agent instructions to show ads. Our synthesis: defenders are learning the traces agent-driven activity leaves.