Node and RPC provider Chainstack has expanded its incident report on an intrusion that ran from October 26 until October 31, when the company detected it and cut the access paths the same day. The attacker used ARTEX, an open-source framework that orchestrates LLM agents to automate intrusions.

Entry came through an internet-exposed test Grafana instance with unchanged default admin credentials. From there the attacker reached an unauthenticated internal MCP tool server with cluster-admin rights, took development credentials that also worked in production, read production secrets in bulk and queried production databases.

Exposed data includes organization names, account holder names, member emails and password hashes. Node credentials were also reachable and are being treated as exposed.

Chainstack says customer nodes, the console and the API were not modified, and no card details were stored. Customers are asked to change passwords, rotate node credentials, regenerate platform API keys and watch for phishing. The last observed use of a copied credential was on November 2.