AI Pentesting Went Commercial: 173 Tenants, One Stolen Secret, and a Fourth-Party Risk Nobody Repriced

ConnectWise detected unauthorized access to seven application identities in its Cloud Backup environment on Oct 14, published its first advisory on Oct 16, and disabled those identities along with Cloud Backup, SaaS Security and Cloud Management at 07:00 UTC on Oct 17. Between 06:13 and 08:34 UTC on Oct 15, attackers authenticated as the vendor's own service principal from a single IP address across managed service provider tenants and their customer tenants. the entire compromise fit inside one application credential and one morning

The disclosure itself carries the tell. ConnectWise's own remediation guide states that the seven applications are vendor-owned multi-tenant applications and that the company cannot be assumed to have permission to make changes inside a customer tenant. The party that owes the disclosure has the least visibility of any party involved. the vendor could not even confirm which of its customers were hit

ARTEX began as a public project and ended as a product. Written as a multi-agent system in Go with a Next.js front end, it was published on GitHub under an AGPL licence by a developer using the alias Autumn-27, was used against South Korean financial institutions from late September, was disclosed by CrowdStrike on Oct 7, closed to the public on Oct 8, and is now being sold: Threatbook's co-founder and chief executive Xue Feng said ARTEX is back with a commercial edition, with an ARTEX Pro build inside the RedAgents.ai cloud platform. turned a defensive research project into a rentable offensive capability

Here is the mispricing. On Oct 21, 2026 — the same day Microsoft published its attribution — Marsh's Global Insurance Market Index showed global cyber insurance rates falling 4% in Q3 2026, a thirteenth consecutive quarterly decline, with US rates flat. Insurers were already tightening on cyber exposures tied to artificial intelligence and vendor dependencies while still cutting price. the market priced a fourth-party risk curve that had never seen an agentic intrusion chain

ConnectWise is private, as are its largest rivals, so the listed proxy for managed service provider software is the only place the market's view of that layer is visible. N-able, which sells remote monitoring, security and vulnerability management to MSPs, reported second-quarter ARR of $544.5M, up 6.0%, and lowered full-year ARR guidance to $562–565M — growth of 4–5%. the listed MSP-software layer is being discounted while the risk inside it compounds

The gap is not a valuation curiosity; it is a statement about where the control point is believed to be. MSP software is sold per technician and priced on renewal, so a customer who loses confidence in one vendor's backup service does not automatically double its budget — it renegotiates. Identity governance is sold per audit, per privileged account and per agent, and the ConnectWise incident converts a compliance checkbox into a scope of work. identity gets paid per question, MSP software gets paid per seat

The abused permissions were consented at install time by an MSP administrator running a completely normal backup deployment, and the credential that unlocked them was a client secret held by the vendor, not a password held by the customer. Okta governs who a human or an AI agent may act as; it does not govern what a vendor's app registration is permitted to do once it is inside the tenant. governs the identity of the actor, not the scope of the vendor's app

The offence stack is an industrial supply chain and its capability layer has listed equity in it. CrowdStrike found the ARTEX instance that hit Korean banks running DeepSeek v4.1-flash as the primary backend, supplemented by GLM-5.3 from Z.AI and Grok 4.6 for additional code work, with DeepSeek likely reached through an API reseller. Z.AI listed in Hong Kong in January 2026 at HK$116.20 a share and closed at HK$460.80 on Oct 20, 2026. the capability that breached 16 Korean institutions is bought from model vendors with public shareholders

The chain is now legible end to end. An operator rented offensive capability, reused a credential the vendor already held, and walked into tenants that had done nothing wrong; the same week, 16 Korean financial institutions lost about 100,000 records to the same framework. Capital has already chosen a side it does not understand: identity vendors compound at double digits while MSP software decelerates to mid-single digits, and insurers are cutting cyber prices into a thirteenth quarter of decline. the fourth-party risk is still priced at close to zero