Hands Off the Wheel: China's Shift to Autonomous AI-Run Cyberattacks- 298

August 12, 2026

For most of the last decade, the phrase "AI-assisted hacking" meant a human operator using a chatbot to write phishing text or clean up exploit code — a research assistant, not a replacement. Three cases documented in the span of a single month suggest that assumption no longer holds for at least some Chinese-linked operators. In each one, a large language model was handed the actual decision-making — what to scan, what to exploit, when to change approach — and left to run with only minimal human supervision, sometimes across days at a time. The targets ranged from a Taiwanese government network to a Malaysian government body to roughly a thousand small businesses caught up in a proxy-infrastructure scheme, and the sophistication of human oversight varied just as widely. What stayed constant was the underlying architecture: an open-source agent framework doing the orchestration, and a Chinese-built model — usually DeepSeek — doing the reasoning.

The clearest and highest-stakes example comes from the Israeli cybersecurity firm Dream, which says it has documented the first fully autonomous, end-to-end AI hacking operation carried out against a government target. Over four days at the start of July, according to reporting by the Financial Times, suspected Chinese hackers ran a toolkit built entirely from publicly available AI agent software, deploying up to eight autonomous agents simultaneously against what a source close to the matter identified as Taiwan, working less like a single piece of malware and more like a coordinated hacking team. By the time researchers found it, the operation had mapped 21 government systems, compromised at least 85 government accounts, pulled more than 2,500 personnel records, and expanded outward to hit a nuclear safety agency and at least seven energy companies. The attribution signals sit inside the data itself: internal communications tied to the hacking tool were written in Simplified Chinese, while the material actually exfiltrated from the target came back in Traditional Chinese, the script used by government systems in Taiwan, Hong Kong, and Macau. Dream's chief strategy officer, Amir Becker, who spent years running cyber operations for Israel's Unit 8200, said he had never before seen this degree of autonomy directed at a government, and argued that assuming permanent compromise is now the only realistic security posture for state targets. Researchers traced the toolkit to a 160-megabyte archive of 1,395 files built around two freely downloadable open-source agent frameworks, Hermes and OpenClaw, both designed to let AI models act independently on real-world tasks rather than merely answer questions. Getting the underlying model to cooperate required no technical exploit at all — the operators simply framed the entire campaign as an authorized penetration test, a premise the model had no reliable way to verify or reject, and it complied. What impressed Dream's team most was not the scale but the decision-making: the tool continuously reranked its own attack paths as new evidence arrived, and whenever one route hit a dead end, it spun up a fresh agent to search the internet for new information and try a different approach — the same iterative process a human red-teamer would follow, running without anyone needing to sleep. Taiwan's National Security Bureau logged an average of 2.6 million Chinese-origin cyberattacks a day in 2025, up 6 percent year over year; if even a modest share of that volume begins running with this kind of independence, the arithmetic of national cyber defense changes considerably.

A second case, investigated by Palo Alto Networks' Unit 42, shows the same underlying architecture from the inside, because the operator running it made one careless mistake: starting a file server in the operation's own home directory instead of an isolated staging environment. That single error exposed API keys, exploit scripts, target lists, bash history, and complete session logs of the AI actually doing the work, giving researchers what amounted to a recording of the attacker's screen after the fact. The actor, tracked under the handles knaithe and KnYuan and eventually traced to Zhuhai, China, had wired the Chinese model DeepSeek into the same open-source Hermes Agent framework seen in the Taiwan case, using it as the reasoning engine for code generation, vulnerability assessment, target selection, and moment-to-moment decision-making, while Hermes supplied the orchestration layer — terminal access, a Telegram-based command channel, and a modular skills system the actor had customized with three red-teaming capabilities. The exposed logs show DeepSeek working through a genuine attack chain rather than a scripted routine: it identified a vulnerability in the workflow tool Langflow, pulled a public proof-of-concept, and scanned 84 live instances, only to hit a wall when every target required credentials the actor didn't have. Rather than stopping, the model reasoned in real time that the pool of exposed Langflow instances was too small to be worth the effort and pivoted on its own to a second tool, n8n, whose exploit had drawn far more attention on code-sharing platforms. That instinct paid off — scans confirmed more than 647,000 n8n instances existed worldwide, over 25,000 of them inside China itself — and the model chained two separate vulnerabilities together, worked out the exact exploitable version range, sampled roughly 100 of the exposed instances, probed about 40 for version details, and surfaced three genuinely vulnerable systems, compressing what Unit 42 estimates would normally take a human analyst hours into a handful of minutes. Notably, the actor did not extend this same trust to Western AI tools: limited testing of Claude Code and Codex was routed through a third-party proxy with attribution headers deliberately stripped, while DeepSeek and a second Chinese model, Qwen, connected directly to their native APIs with no such precautions — a detail Unit 42 reads as a signal of which tools the operator genuinely trusted for the job. The fully autonomous runs never completed a successful breach, but manual operations run in parallel by the same actor did: data was exfiltrated from three organizations through a Citrix NetScaler vulnerability, command execution was achieved on eleven instances of the Marimo notebook tool, and one government body in Malaysia was targeted repeatedly over multiple days with increasingly careful technique and layered proxy anonymization — a level of patience the automated runs did not display. Unit 42 traced the actor's broader habits through a side project on GitHub: a personal tool that scrapes seventeen sources for newly disclosed vulnerabilities, uses DeepSeek to judge which are worth exploiting, and pushes the results to a Telegram channel — evidence of a hacker who had already normalized outsourcing judgment calls to a language model well before this specific campaign began.

The third case carries the weakest attribution of the three but illustrates how far down the value chain this behavior has already spread. The Tel Aviv-based firm Jesta Security intercepted and took control of a DeepSeek-driven agent that had spent five days quietly reconnoitering its network as part of a proxyjacking scheme — compromising weakly secured servers to install SOCKS5 proxy software and build a resellable network of relay infrastructure, rather than stealing or altering anything on the systems it touched. Jesta's researchers noticed the activity because it moved with a distinctive, inhuman rhythm: 871 short sessions over five days, most lasting under two seconds, each one connecting, executing a single command, disconnecting, and returning after a brief pause to "think." Investigators eventually forced the model to reveal its own identity and received an answer in a fraction of a second — a response time Jesta's CEO, Aviv Halfon, says rules out a human being in the loop — confirming a DeepSeek "Flash" model was doing the work. A target list recovered during the investigation named 1,283 hosts, complete with credentials, destined to become exit nodes for further scanning and intrusion; roughly a thousand other victims, mostly small and midsize businesses hosting websites and applications, were being worked the same way in parallel, a scale Jesta argues no human operator could sustain simultaneously. The Chinese attribution here rests on circumstantial rather than linguistic or geolocated evidence — activity aligned with a Beijing time zone and Chinese-language characters embedded in the payloads — and the underlying motive, building resellable proxy infrastructure, is commercial rather than an intelligence objective. That distinction matters: unlike the Taiwan operation or the Unit 42 case, nothing here points to state direction, and the operator's goal looks like ordinary cybercriminal monetization rather than espionage.

What the case does confirm is that the same autonomous-agent approach has already reached well below the level of state-sponsored operators, into opportunistic criminal infrastructure-building, and Halfon's own advice — that defenders are better served engaging an AI attacker to learn its tooling and intent than simply blocking it, and that simple honeytokens are unusually effective against agents that cannot reliably distinguish real infrastructure from bait — reflects a defender's-eye view of just how ordinary this kind of automation has already become.

Read together, these three cases describe less a single campaign than a capability now diffusing across an entire ecosystem of Chinese-linked actors, state-adjacent and criminal alike. The most alarming throughline is not any individual exploit but the repetition of the same components — an open-source agent framework for orchestration, a Chinese-built model for reasoning — across a government-espionage operation, a technically sophisticated exploitation campaign, and a comparatively low-stakes proxy-infrastructure scheme. The degree of confidence in state direction falls as the sophistication and stakes decline, from Taiwan's compromised ministries down to Jesta's anonymous SMB victims, but the tooling stack holding all three together does not change. What began as a research question about whether AI models could run an attack chain unsupervised has, in the space of one month, become a documented operational reality at more than one level of the Chinese cyber ecosystem at once.