Microsoft ties ConnectWise breach to China-aligned hackers using AI agents

Microsoft has blamed a China-aligned hacking group for the breach of IT giant ConnectWise, saying the intruders used AI agents to rapidly hack into thousands of its customers, TechCrunch reported.

The significance is not only that a supplier was compromised, but how. According to Microsoft's account, AI agents did the work of spreading quickly across a very large number of targets, a tempo that manual, one-machine-at-a-time operations struggle to match.

ConnectWise sits near the top of the IT services supply chain, and its customers are themselves businesses. When a provider like this is breached, attackers can move downstream along existing trust relationships, which helps explain how a single intrusion reached thousands of companies.

The attribution to a state-linked actor pushes the story beyond a technical advisory and into diplomatic and regulatory territory. Conclusions of this kind are rarely purely technical statements; they shape how governments and vendors respond.

For defenders, the pressure is a shift in cost structure. Attackers can cover more targets with fewer people, so detection, containment and response have to speed up by a comparable margin or the response window collapses.

The case also sharpens third-party risk. Managed service providers and IT tool vendors hold access into many customer environments at once, which makes them high-value springboards for anyone who can get in.

What to watch next: ConnectWise's own response and customer notifications, whether Microsoft publishes a fuller technical attribution, and how regulators end up characterizing AI agents used as attack tooling.