Prompt Pack

Skip-Level

Microsoft Says Hackers Used AI Agents to Speed a Supply Chain Attack

By · 23 Oct 2026

Skip-Level illustration for “Microsoft Says Hackers Used AI Agents to Speed a Supply Chain Attack”
  • Microsoft says an attacker used an open source AI agent framework to reach privileged cloud access in under 3 hours in multiple cases.
  • 87% of developers say AI helps them ship faster, yet 72% feel the same or more friction than before AI.
  • Only 5% of surveyed leaders say a traditional leader centered model fits the AI era.

Three things engineering and IT managers should know, from AI agents turning a trusted vendor app into a fast attack path to why faster coding has not made the rest of the work move faster.

1. Attackers Used AI Agents to Move at Machine Speed

Microsoft Threat Intelligence says Storm-0940, an actor it ties to the Chinese state, used ARTEX, an open source agentic AI penetration testing framework, to automate attacks on hundreds of organizations starting as early as September 2026. Microsoft assesses the group was behind the recently disclosed ConnectWise supply chain compromise of a multitenant application. After the unauthorized access tied to ConnectWise Cloud Backup, the agents attempted to sign in to more than 2,250 tenants, using apps those tenants had already granted access, so no user had to sign in interactively. In multiple cases, the time from first targeting to privileged access was under 3 hours. A separate password spray from Storm-0940 infrastructure, Oct 10 to 14, peaked at 2,900 failures per minute, though Microsoft observed no successful authentication from that spray. Microsoft says this did not come from a flaw in its own systems, and that a successful authentication does not necessarily mean data was accessed.

Why it matters: The weak point was not a person clicking a link; it was a trusted third party app that already held broad permissions in customer tenants. Microsoft notes that alerts did fire, but the speed left defenders very little time to respond. Our read: any vendor app with high privileges in your tenant is now something an agent can test around the clock. Treat today as the day you ask your identity admin which multitenant apps hold high privileges, and whether any ConnectWise app is installed. Microsoft advises keeping affected ConnectWise connections disabled until ConnectWise issues restoration steps, reviewing tenant activity from at least Oct 15 (service principal sign ins back to Oct 1 where records exist), and not deleting the apps first so evidence is preserved. Source: Microsoft Security Blog on Storm-0940 and ARTEX

2. AI Speeds Up Coding, but the Friction Stays

Atlassian's 2026 State of Developer Experience report, drawing on a survey of more than 1,500 software practitioners, finds 87% of developers say AI helps them ship work faster, yet 72% experience the same or more friction than before AI. In 2025, 68% of developers said they saved 10 or more hours a week; in 2026, that figure is 25%. 65% now regularly spend time correcting AI output, and 49% spend 4 or more hours a week reviewing AI output, correcting prompts, and more. Finding information is again the top source of friction, followed by meetings, context switching, technical debt, and unclear requirements. Only 17% of developers and 23% of leaders say their organization has a clearly communicated and implemented AI strategy.

Why it matters: 60% of developers say AI usage is treated as a productivity signal, and 41% sometimes use it more than necessary because they feel expected to. If your dashboard counts AI usage, you may be rewarding work that lands on reviewers downstream. Atlassian says developers at organizations with a clear AI strategy are twice as likely to experience less friction than before AI. This week, pick one bottleneck, such as finding information or review load, and measure that outcome instead of AI activity. Sources: Atlassian blog and State of Developer Experience Report 2026

3. Leaders Want Hands-On AI Practice, Not Generic Courses

The Conference Board's "Leadership Disrupted" report, drawing on a survey of 775 international leaders and 20 interviews, warns that AI's pace is creating new managerial bottlenecks, fatigue, and the risk of "work slop." Only 5% say a traditional leader centered model is best suited for the AI era, while 36% favor a hybrid model where leadership input and responsibilities are shared. 72% favor hands on practice with AI tools over more traditional development approaches. Continuous AI literacy and knowing when human judgment should override AI tie at 40% each as the top AI expanded leadership competencies, and 36% expect reductions in both frontline managers and project leaders.

Why it matters: Your leads are now reviewing a growing flood of AI generated work, and the report says leaders want role specific, work based development rather than generalized AI fluency courses. Our read: the fastest training is a real review on real work. This week, pair each lead with one live AI assisted task and agree on the point where a human has to step in and override. Sources: The Conference Board report page and The Conference Board release via PR Newswire

Compiled daily with Grok from public sources and edited by the AIDevPulse team.

Get Skip-Level and the daily brief in your inbox: sign up for the AIDevPulse newsletter. For today's developer news, read today's main brief.

Sources:

Recommended AI prompt

Copy this paragraph into ChatGPT, Claude, Gemini, Grok, or whatever AI you use.

Prompt

I manage an engineering or IT team. Turn the three items in this readout into a short team update of about 150 words: one plain sentence per item on what changed, one line on what it means for our team, and one question we should decide this week. Keep my team's context in mind: [describe your team, the third party apps with admin access in your tenant, and how you measure AI use today]. Do not add facts that are not in the readout, and flag anything I should verify before sharing.