"An external attacker gained unauthorized access to part of Chainstack's infrastructure through a third-party component," the company said.
How Chainstack says the intrusion unfolded
Chainstack disclosed that an intrusion began with access to a development environment on October 26, 2026, and that the attacker then "escalated their access to break into some parts of our production environment." The company says the intrusion was detected on October 31, 2026, and that access was cut off that same day. Chainstack added that it "detected the intrusion, cut the access paths, and are hardening our systems."
Data and credentials the attacker accessed, per Chainstack
According to Chainstack, the threat actor accessed a database that contained customer account information. The company listed the exposed fields as:
- organization names
- account holder names
- the email addresses of organization’s members on Chainstack
- password hashes
Chainstack also reported that "the attacker also had access to systems holding node credentials." The company said it has "no evidence they were read, but we are treating them as exposed and ask customers to rotate them." Chainstack advised customers to rotate node credentials, regenerate platform API keys, update passwords — including on other services where the same password has been reused — and remain alert to potential phishing attempts.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadARTEX and a cluster of related incidents
Chainstack assessed the incident as sharing overlaps "with a campaign undertaken by a China-linked cluster to target high-value firms using ARTEX." That same autonomous AI agent framework has been implicated in other recent incidents reported in the source material.
WorkOS disclosed a security incident that likewise involved "the same autonomous AI agent framework to conduct offensive security operations." WorkOS said the incident was discovered on October 30, 2026, and was limited to its go-to-market (GTM) systems; it did not affect production systems or customer platform data. WorkOS said the accessed data included business contact details, business account and relationship information, customer communications (including summaries and excerpts from sales calls, support discussions, and Slack conversations), and operational metadata describing product usage and connection or directory health. As WorkOS put it, "This increases the speed and scale of attacks that exploit weaknesses such as exposed applications and stolen credentials."
Chainalysis also reported detecting "an external actor using offensive agentic techniques" to obtain access to its systems and internal tools. As of November 2, 2026, Chainalysis said it had proactively taken its Reactor and Data Solutions products offline. The company said it was "closely monitoring these systems for unusual activity and will keep you apprised of new information so you can make informed decisions for your business and operations."
Separately, the Dutch Institute for Vulnerability Disclosure (DIVD) reported a September 21, 2026 breach in which attackers exploited two zero-day flaws in the open-source Zammad ticketing system — CVE-2026-102489 and CVE-2026-102490 — enabling privilege escalation, remote code execution, and data exfiltration.
What this means for Chainstack customers, platform security teams, and open-source maintainers
- Chainstack customers: The company has instructed customers to rotate node credentials, regenerate platform API keys, and update passwords — especially where passwords are reused — and to remain vigilant for phishing. Those are the concrete steps Chainstack has asked customers to take.
- Platform security teams and operators: Chainstack's timeline — access to dev on October 26, escalation to production, detection and cutoff on October 31 — illustrates the speed with which an exploit chain can progress. WorkOS's warning that ARTEX "increases the speed and scale of attacks" underscores the need for rapid remediation and cross-system monitoring that can link suspicious activity.
- Open-source maintainers: The DIVD disclosure shows zero-days in widely used tooling can be leveraged to expand compromise. The Zammad CVEs cited (CVE-2026-102489 and CVE-2026-102490) are an explicit example referenced alongside the ARTEX activity.
A narrow containment, and a broader warning
Chainstack contained the intrusion by detecting the activity and cutting access paths on October 31, 2026, and it is "hardening our systems." Still, the company is treating node credentials as exposed despite saying it has "no evidence they were read." That ambiguity — no evidence of reading, but an abundance of caution in treating credentials as compromised — is a concrete choice reflected in Chainstack's customer guidance.
The broader pattern in the disclosures is clear in the source material: ARTEX-style autonomous agents have been used across multiple incidents to automate offensive operations and tie together reconnaissance, credential theft, and exploitation. WorkOS described this dynamic as increasing attack "speed and scale," Chainalysis has taken products offline while monitoring "for unusual activity," and previous exploitation of Zammad zero-days demonstrates how tooling flaws can be chained into larger compromises.
Two practical, unresolved facts remain in the public statements cited here: whether forensic work will determine if node credentials were actually read or used, and whether further overlaps among the affected organizations will surface as investigations continue. For customers and defenders, the immediate directive is concrete — rotate, regenerate, update, and watch for phishing — while the ongoing investigations will determine how extensive ARTEX-driven campaigns ultimately prove to be.
