Chinese state hackers double attack volume using DeepSeek

Several hacking groups linked to the Chinese government have found a more efficient way to break into their victims' systems: folding DeepSeek and other open-source AI models into different stages of their attacks. Taiwanese cybersecurity firm TeamT5 has documented that several of these groups have doubled the volume of their operations since they started relying on the technology. For now, researchers say, AI is confined to support tasks — reconnaissance, malicious code generation and lateral movement inside networks already compromised — rather than hacking systems fully on its own.

Four groups, four different uses

• Grimfengxi relied on DeepSeek to generate exploit code.
• Huapi used the AI to attack the email system of a Taiwanese company.
• Teleboyi used the model to collect more than 1,000 IP addresses and map a target company's domains.
• Slime22 went a step further, adding Anthropic's Claude Code to pose as an engineer running security tests inside a Taiwanese tech company.

DeepSeek is the AI of choice for Chinese hackers because it's relatively powerful and has very few cybersecurity guardrails.

Li adds that Western models are sought after too, but their stricter restrictions demand considerably more effort to bypass.

The limits of autonomy

One of the main fears around AI is that it could become capable of carrying out cyberattacks on its own. That is one of the reasons the United States had slowed the rollout of "Claude Mythos" and OpenAI's most capable model, after both companies said their systems could execute complex attacks and solve expert-level vulnerability challenges.

For now, though, hackers cannot reliably automate cyberattacks. Unit 42, Palo Alto Networks' threat research division, documented the case of an attacker who tried to breach more than 460 targets by combining autonomous and manual methods, using a system built on DeepSeek. The system scanned the internet for vulnerable software, pulled exploit code from GitHub, and reasoned autonomously about which target to attack. DeepSeek chose the automation platform n8n after finding more than 25,000 exposed installations in China; after sampling them, the agent identified three vulnerable versions, but all three required authentication and none could be exploited. The only attacks that succeeded were carried out manually, when the attacker extracted data and ran commands directly.

The success rate of the autonomous attempts confirms that AI is not yet ready to carry out intrusions without human supervision. Lab tests have worked in some cases, but always in simulated environments, without active defenses such as monitoring or incident response.

The Claude Code precedent

In November 2025, Anthropic said a group backed by the Chinese state had used Claude Code to automate between 80% and 90% of an espionage campaign targeting roughly 30 organizations, though only a small number of attempts succeeded. The company called it, at the time, the first documented case of a large-scale cyberattack executed without substantial human intervention — a claim that opened up a debate in the cybersecurity community. Anthropic has since blocked access to its services from companies controlled by the Chinese state.

I refuse to believe attackers are getting these models to do things nobody else can accomplish.

Researcher Kevin Beaumont, for his part, argues hackers aren't inventing anything new, comparing these tools to Metasploit, a framework created in 2003 for developing and running exploits against remote targets. Another finding, documented by the firm CyCraft and reported by Bloomberg, shows a group that sells intrusion software turned to OpenAI's ChatGPT during an attack on a Western think tank: after obtaining an employee's local Signal database, the attackers consulted the chatbot to help build a module capable of decrypting it.

For security teams and technology companies across the US, UK and other English-speaking markets, the case is a reminder that vigilance needs to extend to internet-exposed automation tools — like n8n — and to mail and collaboration systems connected to low-cost AI providers, precisely the entry points Chinese-linked groups have exploited first outside their own borders. The gap isn't more sophisticated models; it's how fast attackers adopt cheap, accessible tools to move faster. The episode also reopens the broader question of AI agent governance, the framework that defines responsibility and limits as these systems act with growing autonomy inside an organization.