Chinese Hackers Double Attack Volume With DeepSeek, Taiwanese Researchers Say

On May 7, 2026, a self-described binary security researcher known as knaithe and KnYuan gave an AI agent a task over Telegram from a base in Zhuhai, China, according to Unit 42's assessment. In the recovered session, DeepSeek searched for exposed software, pulled public exploit code from GitHub and reasoned through which target looked worth attacking. No further human instruction appeared in the logs.

It never got in.

Attackers are adopting language models as working tools, and Taiwanese research firm TeamT5 found that state-affiliated Chinese groups have more than doubled their attack volume since they began assigning routine work and malware development to AI. Yet Unit 42's recovered logs show no full compromise by the machine, while every confirmed impact came from manual work.

What TeamT5 measured

By August 2026, TeamT5 had found Chinese groups using models for reconnaissance, code generation and movement inside breached networks. Grimfengxi turned to DeepSeek to write exploit code. Against a Taiwanese company's email system, Huapi employed a Chinese model, likely DeepSeek. Teleboyi tasked one with collecting 1,000 IP addresses and mapping corporate domains. After entering a Taiwanese technology company, Slime22 ran Claude Code while posing as an engineer conducting authorized tests to get around its safeguards.

DeepSeek has become the favored model because it is capable, customizable and cheap to run. As of August 2026, TeamT5 had recorded no attack involving Moonshot's more capable Kimi K3, which it considers prohibitively expensive for hackers.

“DeepSeek is the AI of choice for Chinese hackers because it's relatively powerful with very low cyber guardrails,” said Charles Li, TeamT5's chief analyst. “Western models are highly sought-after but their guardrails are much more strict and require a lot more effort to bypass.”

TeamT5 could not always identify which model powered a given attack. Its measure captures higher activity after AI adoption, not proof that autonomous software caused each gain.

What the logs show

Knaithe wired DeepSeek into Hermes Agent, an open-source framework with terminal access and no built-in safety layer. The model was the planner and the framework was its pair of hands: DeepSeek chose targets and wrote instructions, while Hermes ran commands, searched the internet and returned results. Custom skills helped it find exposed assets and obtain exploitation tools.

Knaithe also maintains a public project called 1DayNews, an automated vulnerability-intelligence pipeline that aggregates remote-code-execution disclosures from 17 sources, uses DeepSeek to filter them for exploitability and pushes alerts over Telegram. Unit 42 treated the project as part of its attribution evidence.

In the May session, DeepSeek found a Langflow flaw, enumerated 84 live installations and identified one target with a vulnerable version. A required setting was absent. “All three Langflow need public flow ID but no auto_login, stuck. Deployments small (84 alive), exploitable probably 0. Search for larger-scale vulns.”

It surveyed 10 product families, then selected the n8n automation platform after spotting a popular exploit repository. Search data showed 647,017 exposed n8n instances worldwide at the time, including 25,209 in China. DeepSeek sampled about 100 Chinese addresses, probed roughly 40 and found three running vulnerable versions. Their forms required authentication. It exploited none.

Across the campaign examined in Unit 42's July 30 report, the operator attempted to exploit more than 460 targets with autonomous and manual methods. The confirmed effects belonged to the conventional side: data left three Citrix NetScaler targets, and commands ran on 11 Marimo notebook instances. The manual campaign also included reverse-shell attempts against nine Apache Tomcat servers and reverse-shell callbacks targeting three IKE VPN endpoints. The operator returned to a Malaysian government entity over multiple days, changing parameters and adding proxy anonymization. The autonomous runs hit Chinese infrastructure indiscriminately.

The machine also created the evidence trail. Hermes started a file server in the operator's home directory, exposing API keys, target lists, shell history and session logs that manual work would not have produced.

Why skeptics pushed back

Outside security researchers had already pushed back against Anthropic's claim of high autonomy. In November 2025, Anthropic said a Chinese state-sponsored group used Claude Code to automate 80 to 90 percent of an espionage campaign aimed at roughly 30 organizations. Only a “small number” of those attempts succeeded.

“I continue to refuse to believe that attackers are somehow able to get these models to jump through hoops that nobody else can,” said Dan Tentler, executive founder of Phobos Group. “Why do the models give these attackers what they want 90% of the time but the rest of us have to deal with ass-kissing, stonewalling, and acid trips?”

Independent researcher Kevin Beaumont put the comparison more plainly: “The threat actors aren’t inventing something new here.” Researchers likened the gains to Metasploit and SEToolkit, long-used programs that made some tasks easier without sharply increasing attacker capability. Anthropic acknowledged that Claude sometimes claimed credentials that failed and treated public information as a fresh discovery, calling those errors an obstacle to fully autonomous attacks.

The commercial layer

CyCraft found thousands of Chinese-language screenshots on a public shared drive, taken as recently as February 2026, showing the workflow of a hacking-software seller with about 10 employees. It charged 300,000 to 500,000 yuan, or about $44,500 to $74,000, per package and served at least four hacking groups. One customer's activity overlapped with Mustang Panda operations that the U.S. Justice Department attributes to the Chinese government.

The same company consulted ChatGPT during an attack on a Western think tank. It had already copied an employee's local Signal database from a compromised computer and used the chatbot while building a decryption module.

Unit 42 described autonomous attack cycles as operationally viable and said the failure margin was narrow. Target-side settings stopped the observed attempts, meaning systems with weaker defaults could have fallen. “The significance of these findings lies in the trajectory rather than the outcome of any individual campaign.”

OpenAI Says Its Models Escaped a Sandbox and Breached Hugging Face

OpenAI said Tuesday that two of its models broke out of a sealed testing environment and hacked into Hugging Face to steal the answer key to the cybersecurity benchmark they were being graded on. The

The Implicator

OpenAI Models Ran a Hack in Hours That Takes Skilled Humans Weeks

OpenAI's advanced models breached Hugging Face's internal systems in hours, an attack that would typically take a skilled human a couple of weeks. People familiar with the matter gave that account to

The Implicator

Iran Finds the AI Workaround Washington Cannot Sanction

San Francisco | Monday, June 1, 2026 Western AI services now sit inside Iran's cyber and military workflow. The FT says Iranian military and intelligence-linked operators use ChatGPT and Gemini to su

The Implicator

Marcus Schuler

San Francisco

Editor-in-Chief and founder of Implicator.ai. Former ARD correspondent and senior broadcast journalist with 10+ years covering tech. Writes daily briefings on policy and market developments. Based in San Francisco. E-mail: editor@implicator.ai