Chinese Hackers Ran AI Agents Against 200 Organizations

Security researchers say a China-linked hacking group has used AI agents to run several intrusions at once. CrowdStrike reports that one human operator directed the break-ins, and that the campaign was aimed at more than 200 organizations in 14 countries.

A forged token in Greece

One case involves a Greek government entity. CrowdStrike says the AI agents forged an administrator token there. They used authentication keys from a 2022 export of a mail-server directory, and then read mailboxes. The researchers track the group behind the operation as Vapor Panda.

In one intrusion, the researchers believe, the agents used more than 1.4 billion input tokens. Tokens are the units of text a language model reads, —

A tool that left the open-source world

The framework is ARTEX, built for penetration testing, the practice of probing systems for weaknesses. Chinese developers first released it as an open-source project. Its creators later turned it into a proprietary product once it had been used in real attacks, among them one on South Korean financial firms.

In this operation Vapor Panda also used DeepSeek and a second commercial language model that has not been identified. Those models coordinated planning agents and worker agents across the intrusions. The attackers gave instructions in Chinese and stepped in when a decision was needed.

Targets, and what is confirmed

Activity began on October 17. Government ministries, telecom providers, and firms in pharmaceuticals, semiconductors, defense, nuclear and finance were in scope. Not every target fell: CrowdStrike confirms at least nine compromised organizations. Password spraying, which tries a few common passwords across many accounts, and credential scanning hit at least 12 other high-value targets.

Telecom providers in the United States and Belgium are among the confirmed victims, along with government bodies in Greece, the Middle East and Latin America and US pharmaceutical firms. Against government entities in Latin America and the Middle East the group also deployed BLOODALCHEMY, a backdoor active since 2023.

Agents told to avoid Falcon

The agents mapped their targets, found and used software flaws, installed web shells (small scripts that give remote access to a server) and collected credentials. When one path closed, they looked for another.

The operators explicitly told them to skip Windows machines protected by Falcon, CrowdStrike's endpoint protection product, and to work on unprotected hosts.

A Dutch breach with the same tool

The Dutch Institute for Vulnerability Disclosure (DIVD) has updated its account of an attack on its own network in September 2026. It had attributed the attack to an AI agent, and now names ARTEX AI, acting autonomously. A LinkedIn post says the attacker went from first access to root privileges in 12 minutes. It combined one zero-day flaw in Zammad with another that raised its privileges on the machine.

The agent ran many tasks in parallel: one task read a hijacked mailbox, another mapped the internal network, others pulled out login tokens and tried to reset passwords. DIVD recorded more than 450,000 requests and 2,500 scripts tied to the attack, and called the activity "super loud and messy".

Our View

The Falcon instruction shows that attackers can steer AI agents around named security products. The DIVD case adds a contrast: fast, but noisy. Neither report says how much of the speed comes from the models and how much from the human operator. No explanation is given for the gap between more than 200 targeted organizations and nine confirmed compromises, and that gap matters when judging how effective the method is.

Source: BleepingComputer