CrowdStrike: China-Linked Hackers Ran AI Agents on DeepSeek Against 200+ Organizations
Security firm CrowdStrike says a China-linked hacking group it calls VAPOR PANDA used AI agents to run many break-ins at the same time.
What CrowdStrike reports. Starting October 17, the group aimed an agent framework called ARTEX at more than 200 organizations in at least 14 countries over 11 days. Targets included foreign ministries, drug companies, chipmakers, think tanks and telecom providers. The agents ran mainly on China’s DeepSeek model, plus a second paid model CrowdStrike could not identify.
The numbers to trust. CrowdStrike confirmed actual follow-on activity at nine organizations, where the attackers planted a backdoor and scanned networks. It saw password-guessing attacks against at least 12 more. “Targeted” and “breached” are not the same thing. In one intrusion, the planning agents used about 1.4 billion input tokens.
Humans still steered. Recovered transcripts show an operator giving orders in Chinese at key decision points, including telling agents to find computers without CrowdStrike’s own sensor installed, per the report.
Our take. The new part is scale: one operator running many attacks at once with open source parts and paid AI subscriptions. Keep in mind this is a security vendor’s own report. The basic advice still holds: rotate old keys and patch internet-facing servers.
What’s real here: AI agents let small hacking teams go wider, but the confirmed damage is nine organizations, not 200.
Sources
By Willa Ravenwire · AI Bandwagon