State-affiliated Chinese cyber espionage groups have more than doubled their operational attack volume by integrating open-weight artificial intelligence models into routine reconnaissance and script generation workflows, according to threat intelligence from Taiwanese cybersecurity firm TeamT5 and reporting by Bloomberg.
The surge in offensive volume is driven primarily by DeepSeek models, which threat actors favor due to low inference costs, local deployment options, and minimal safety guardrails compared to Western frontier APIs. However, forensic analysis of in-the-wild campaigns by Palo Alto Networks' Unit 42 indicates that while language models accelerate the discovery and triage of potential targets, fully autonomous exploitation attempts continue to fail against standard authentication and configuration barriers.
Reconnaissance Acceleration and Model Selection
According to TeamT5 chief analyst Charles Li, multiple threat actors linked to Chinese state operations have embedded language models into their operational infrastructure. Tracked groups including Grimfengxi, Huapi, Teleboyi, and Slime22 have deployed models to automate target scanning, map corporate subnets, and generate bespoke exploitation scripts.
DeepSeek has emerged as the primary tool across these campaigns. While Western models enforce strict safety filters that require prompt injection or persona spoofing to bypass, open-weight models like DeepSeek can be fine-tuned or served on local hardware without centralized policy enforcement. TeamT5 noted that more capable commercial alternatives such as Moonshot's Kimi K3 have not been observed in active campaigns, likely due to higher API costs for continuous automated tasks.
Forensic Realities of Autonomous Execution
Despite substantial increases in probing activity, autonomous execution logs document significant operational limitations. In a technical teardown of an offensive campaign tracked by Unit 42, an operator operating under the aliases "knaithe" and "KnYuan" wired DeepSeek into an open-source terminal orchestration harness to scan and exploit internet-facing targets.
The agentic setup autonomously scanned global software deployments, enumerating 25,209 exposed n8n instances located in China and narrowing the pool to three targets running vulnerable software versions. However, the model failed to achieve compromise because the target systems required standard authentication forms that the autonomous agent could not bypass.
Across a campaign spanning more than 460 attempted targets, Unit 42 confirmed that all successful intrusions relied entirely on manual exploitation by human operators:
- Manual Exploitation: Confirmed data exfiltration across three Citrix NetScaler endpoints and arbitrary command execution on 11 Marimo notebook servers were carried out by human operators rather than autonomous agent loops.
- Operational Artifacts: The autonomous framework inadvertently created an extensive forensic footprint, starting an exposed local file server that leaked operator API keys, target lists, and shell history to security researchers.
- Target Indiscrimination: While manual human operators conducted targeted, multi-day intrusions against government and corporate targets using proxy anonymization, the autonomous agent probed internal Chinese infrastructure indiscriminately.
Industry Skepticism Over AI Autonomy Claims
The findings align with growing skepticism among independent security analysts regarding vendor claims of near-total attack automation. Following claims by frontier AI labs that models could automate up to 90% of complex cyber operations, researchers including Kevin Beaumont and Dan Tentler noted that language models function more like force-multipliers for existing tooling (comparable to Metasploit modules) rather than self-directed offensive operators.
Security analysts emphasize that while AI agents substantially lower the barrier to rapid reconnaissance and code prototyping, defensive hygiene (such as mandatory multi-factor authentication, rapid patch cycles, and restricted public network exposure) remains effective against current automated LLM attack workflows.
