Taiwanese threat intelligence firm TeamT5 has revealed that a Chinese state-linked cyber group it tracks has more than doubled its attack volume since it began using AI. Bloomberg reported the finding on August 24, 2026. What has changed isn't the flashiness of the attack techniques, but the sheer volume of work—reconnaissance, vulnerability triage, code generation—that can now be processed in the same amount of time. However, TeamT5 has not disclosed the comparison period or the underlying sample size, so the increase cannot be attributed solely to AI.
Even so, AI's penetration into the mechanics of attacks is deepening. In 2024, AI use centered on research, translation, and debugging. By 2026, agents were selecting targets, ingesting publicly available proof-of-concept code, and attempting intrusions on their own. Defenders need to track not which model was used, but what the AI was told to search for and under what privileges it was allowed to execute.
The "more than doubled" figure lacks a timeframe and denominator
According to TeamT5, a Chinese state-linked group began offloading routine tasks to AI while also using it to develop more sophisticated malware, and in the process more than doubled the number of attacks it carried out. The firm says that scripts and logs obtained in recent months show models such as DeepSeek being used for reconnaissance and for generating exploitation techniques.
This figure represents the scope of what TeamT5 itself observed. The public materials do not specify what periods were compared, what the sample size was, or how attempts versus successful breaches were counted. Nor is it clear how regional or client-based skew, or duplicate counting of the same attack, were handled. As a result, the finding cannot be generalized into a claim that "Chinese state-sponsored cyberattacks overall have doubled because of AI."
Causality also requires caution. Even if the timing of AI adoption overlaps with the rise in attack volume, other factors remain in play—more personnel, an expanded set of target regions, or simply more vulnerabilities being disclosed. What can be said with confidence at this point is only that attack volume rose within the groups TeamT5 tracks, and that AI use appeared in the same groups' operational logs.
From collecting 1,000 IP addresses to post-intrusion lateral movement
Looking at individual cases, the tasks AI has taken on are concrete. A group TeamT5 calls Grimfengxi used DeepSeek to generate exploit code. Huapi is said to have used a Chinese-made model—likely DeepSeek—to attack the email systems of a Taiwanese company, though the model's identity remains an inference.
Teleboyi used the same platform to collect 1,000 internet-facing IP addresses and match them against target companies' domains. This isn't intrusion itself, but the reconnaissance work that precedes it. Still, handing off to a model the kind of repetitive work that a human would otherwise do by adjusting search parameters over and over lets attackers expand their pool of candidates in a fraction of the time. This is the use case most directly tied to the rise in attack numbers.
AI also shows up after the intrusion. According to TeamT5, after breaching a Taiwanese tech company, Slime22 had Claude Code operate a Kali environment to attempt lateral movement across the internal network. The attacker reportedly evaded defenses by issuing instructions that posed as a legitimate security engineer. Here, it wasn't a chatbot offering advice—a code agent tied to an execution environment was advancing the attack workflow itself.
Chief analyst Charles Li cited DeepSeek's relatively strong performance and its weak guardrails around cybersecurity topics as reasons for its popularity among attackers. While TeamT5 views Moonshot's Kimi K3 as more capable, its higher operating cost means the firm has yet to observe any cases where Kimi K3 was used. For attackers, what matters isn't peak performance but the ability to iterate cheaply and avoid refusals.
An autonomous loop that narrowed 25,209 targets down
Another public case study fleshes out this increase in processing capacity in more detail. On July 30, 2026, Palo Alto Networks' Unit 42 published records of a Chinese-speaking threat actor using DeepSeek as an inference engine to run target discovery and attacks through something called Hermes Agent. Because this individual has not been identified as Chinese state-linked, the case should be treated separately from TeamT5's tally.
In a reconstructed session from May 7, 2026, the agent first enumerated 84 Langflow instances and pulled publicly available proof-of-concept code. It found one vulnerable version, but couldn't breach it because a configuration setting required for the attack was disabled. DeepSeek then judged the target product to be low-value, examined ten other product categories along with vulnerability data on GitHub, and pivoted to n8n instead.
A FOFA search turned up 25,209 internet-exposed n8n instances inside China. DeepSeek extracted roughly 100 IP addresses from that pool and checked around 40 versions. It automatically attempted exploitation against three vulnerable versions but was blocked by authentication on the public-facing forms. The autonomous process failed to achieve a breach.
Even in failure, the shift in offensive capability is visible. The agent moved through discovery, candidate evaluation, proof-of-concept retrieval, attack, and pivoting to another product—all within a single loop. According to Unit 42, this actor targeted more than 460 systems combining manual and automated efforts. However, the three confirmed data thefts and the 11 cases of command execution on Marimo Notebook that the firm identified were achievements of the manual campaign side, not successes attributable to the autonomous AI.
Defensive configurations actually worked. In the Langflow case, a required setting was missing; in the n8n case, authentication was enabled—both stopped the automated exploitation. The agent also made an operational mistake, spinning up a file server inside the attacker's own home directory and exposing its tool configurations and logs externally. AI speeds up attacks, but it executes the attacker's own operational mistakes at the same speed.
From research assistance to post-intrusion work
Comparing public materials chronologically reveals a shift in the scope of use. In the five state-linked attacker accounts OpenAI suspended in February 2024—including China-linked Charcoal Typhoon and Salmon Typhoon—the primary uses were researching public information, translation, code debugging, and basic script generation. This was largely AI assisting existing workflows.
By September 2025, use had advanced into the execution stage. Anthropic disclosed that a group it assessed with high confidence as Chinese state-sponsored had operated Claude Code to attempt intrusions against roughly 30 organizations worldwide. Targets reportedly included major tech companies, financial institutions, and government agencies, with a small number of successful breaches. The model advanced command execution and credential theft, with human involvement limited to key decision points.
Anthropic's 2026 analysis of 832 accounts also shows usage shifting toward post-intrusion work. Of these, 560 accounts—67.3%—used AI for malware creation, and 54 accounts—6.5%—used it for lateral movement. The share of users classified as medium risk or higher rose from 33% in the first six months of the analysis period to 56% in the second six months. This is observational data specific to Claude and not a statistic representing threat actors worldwide. Even so, the direction aligns with the behavior TeamT5 reported for Slime22.
Model names alone don't measure risk. Anthropic's analysis found no correlation between whether an attacker used Claude Code, the API, or the chat interface and their risk level. What drove the difference was the mechanism connecting multiple attack stages together, and the privileges granted to control endpoints and networks.
Narrowing the execution footprint matters more than banning models
What defenders need to monitor extends well beyond access logs for specific models. Reduce internet-exposed assets, and require authentication on admin panels and forms. Grant code agents minimal execution privileges, and flag it when external search, shell execution, and file access occur in rapid succession within a short window. In the Unit 42 case, these basic configurations were enough to stop an autonomous attack.
Guardrails on the AI side are also stopping attacks. Unit 42's investigation found that the attacker also tried Western coding tools, but OpenAI refused requests that violated its policies and suspended accounts believed to be connected. Meanwhile, the attacker paired DeepSeek with an unconstrained agent framework. Relying solely on API-level refusals offers no protection once an attacker moves to a self-managed execution environment.
Evaluating TeamT5's "more than doubled" figure will require future disclosure of the observation period, sample size, and how attacks were defined. While we wait for those numbers, authentication on public-facing assets and agent privileges can be verified right now. If attackers are using AI to compress the time from discovery to execution, the metric defenders should be tracking isn't the brand of model involved—it's the time elapsed between a vulnerability's disclosure and the completion of its patch.