Microsoft's CISO Wants AI Pen-Testing Framework Regulated. Security Leaders Say It's Too Late

An LLM-driven penetration testing framework has been forked more than 12,000 times, and Microsoft's global CISO says governments need to step in before autonomous, machine-speed attacks spiral out of control.

In a LinkedIn post this week, Igor Tsyganskiy, executive vice president and global CISO at Microsoft, warned that Artex's use "is spreading like fire" across the internet and called it "extremely dangerous" in the wrong hands.

"Most frequently, those who use AI models for cyber offense have very little understanding of the limitations and unpredictable behavior of such models," Tsyganskiy wrote. "I urge policymakers across the world to urgently regulate the release and use of such dangerous frameworks, especially in open source form."

Here's what's actually at stake: Artex isn't a script or a scanner. It's a multi-agent pen testing framework that, given a target and a high-level goal by a human operator, autonomously plans and executes sophisticated attacks at machine speed. An independent developer using the GitHub handle Autumn-27 released it in July as a legitimate, open source tool.

What happened after release?

Things moved fast. Within a couple of months, threat researchers began linking the framework to major attacks. The developer responded by making Artex closed source — but by then, according to cloud security vendor Wiz, the code had already been forked more than 12,000 times.

That's 12,000-plus independent copies living outside anyone's control, including on criminal infrastructure. Reported abuse reads like a catalog of modern intrusion tradecraft:

• Sophisticated espionage campaigns
• Attacks on financial firms
• Scanning GitHub for exposed secrets
• Theft of gaming account credentials

Why is an unpredictable attack tool worse?

Tsyganskiy's core argument is about control, not capability. Artex is nondeterministic: it behaves unpredictably and doesn't always align its actions with the operator's intent. It's technically easy to use but potentially difficult to rein in.

The scenario he and others worry about is scope creep at attack speed. A cybercriminal tasks the AI with hacking one company — and the framework feasibly attacks every organization in the same industry. In critical infrastructure sectors such as healthcare, utilities and banking, the consequences could be dire.

Would regulation actually work?

What does this change for security teams? Probably not much, if regulation is the answer you're waiting for. Several security leaders agree Artex in criminal hands is a serious concern — and argue that legislating it away is a dead end.

"These tools can be forked, replicated, modified and redistributed in a minute," Thomas Roccia, founder of threat intelligence firm SecurityBreak and former lead AI security researcher at Microsoft, told TechTarget. "Criminals won't respect a ban, and trying to regulate every offensive framework is an impossible task."

Roccia speaks from practical experience: his team currently uses Artex, along with about 20 other offensive AI tools, to conduct threat intelligence research.

Others warn that regulation would hit defenders hardest. "Criminals won't care [about regulations], and the people who actually get hurt are our own red teams," Boban Kršić, CISO at Fresenius Group, a global healthcare company based in Germany, wrote in response to Tsyganskiy's post.

So what should CISOs do instead?

Rather than trying to disarm the adversary through legislation, Kršić argued, defenders should reinforce their existing security posture. That means nailing the fundamentals that stop both human-speed and machine-speed attacks:

• Identity and access management
• Patch management
• Phishing-resistant MFA
• Honeypots to distract and flag adversarial agents

"Rather than attempting to control the tools, we should focus on our ability to detect and defend against autonomous attacks," Roccia agreed.

He's not anti-policy — he just aims it elsewhere. Regulatory policy could make a real difference, he said, in establishing and enforcing norms around threat intelligence sharing, automated detection capabilities, cross-border investigations and incident response.

"Another important question is accountability. Who is legally responsible when an autonomous AI agent conducts an unauthorized attack or acts beyond the intended scope?" Roccia said. "I believe these are the important areas where policy could make a difference."

The disagreement, in the end, isn't about whether Artex is dangerous. It's about whether the bottle still has a cork. Twelve thousand forks later, most security leaders think it doesn't.