Security August 25, 2026

Chinese Hackers Increased Their Output With AI. DeepSeek's Low-Guardrail Appeal Shows the Harder Problem.

TeamT5 says Chinese state-affiliated hacking groups more than doubled their attack volume after adopting AI tools, with DeepSeek attractive for its low cyber guardrails. That finding, alongside Dream Security's account of a near-autonomous AI-agent intrusion against Taiwan, shows why safety filters at frontier-model providers cannot contain a threat that can move to locally run open-weight models.

In early July, a hacking tool spent four days probing Taiwanese government systems. Dream Security, the Israeli company that analyzed evidence of the operation, says it compromised at least 85 accounts and extracted more than 2,500 personnel records. Taiwan's Ministry of Digital Affairs later confirmed that foreign hackers used AI tools against government systems and said the affected units had handled the incident.

Dream describes the case as a near-autonomous, end-to-end intrusion against a government target: the attackers combined the open-source agent frameworks Hermes and OpenClaw to map systems, investigate weaknesses, attempt intrusions, and change tactics when blocked. Its public report says human operators set the mission and used an authorized-penetration-test pretext to bypass model safeguards; it does not identify the underlying model used by the agents.

That distinction matters. This was not an AI independently choosing a target or operating without human direction. But Dream's account does show agents performing much of the reconnaissance, testing, coordination, and adaptation that otherwise requires a human operator at every step.

Taiwan's Ministry of Digital Affairs calls the campaign a hybrid of manual work and AI-agent assistance, and attributes it only to an overseas source. The ministry has not publicly confirmed every target, count, or technical detail in Dream's account, but says it reinforced protective guidance after the incident.

The Volume Problem Nobody Mentioned

The Taiwan case made headlines. A separate TeamT5 finding reported the same week points to another problem: state-affiliated Chinese groups more than doubled their attack volume after delegating routine tasks and malware development to AI, according to the Taiwanese threat-intelligence firm.

TeamT5 chief analyst Charles Li told Bloomberg that DeepSeek was the preferred option because it was relatively capable while having low cyber guardrails; he contrasted it with Western models, which he said were more tightly restricted. The report is evidence of relative friction, not proof that any provider's guardrails categorically stop abuse: it also says Western models are sought after and that operators attempt to bypass their safeguards.

Reported examples include Grimfengxi using DeepSeek for exploit code and Teleboyi using AI for IP-address collection and attack-surface mapping. The reporting does not establish that DeepSeek alone caused the rise in volume, or that every group used the same model. North Korean group Kimsuky was also reported to be experimenting with local models — a reminder that the operational shift is not exclusively a China story.

The resulting threat landscape is less centered on a single frontier API than it first appears. Open-weight models that are capable enough for routine offensive work can be run locally, adapted, and used without a provider observing each request. Selected DeepSeek model weights and code are publicly available under MIT licensing, making that deployment model materially different from a controlled hosted service.

The Guardrail Paradox

This creates an awkward situation for the AI safety community.

The intensive focus on responsible deployment — usage policies, alignment training, red-teaming, safety evaluations, and export controls — can add useful friction. TeamT5's reported preference finding suggests that friction affects attacker tool choice. It does not, by itself, establish that the threat landscape is safer or that Western-model safeguards always hold.

That is the paradox. A provider can make abuse harder in its own service while demand moves to models that can be deployed locally and modified outside that provider's control. The important operational question is no longer only which frontier API will answer an abusive request. It is also which capable models are available to run in an environment with no central enforcement point.

The policy implication is uncomfortable: guarding frontier capabilities remains important, but it cannot be the whole strategy. Defenders also need to account for the large population of lower-cost, locally deployable models that may be good enough for reconnaissance, automation, and iterative intrusion work.

The Autonomy Gap

Dream's report introduces a different and slower-moving problem. Even with human operators setting objectives, the transition from "AI as a writing assistant for exploit code" to an agent system that conducts much of an intrusion workflow can compress the timeline dramatically.

Traditional cyberattack cycles depend on the fact that reconnaissance and exploitation are slow and require repeated human judgment. AI agents collapse that loop. A campaign that might take a skilled team several weeks can, in principle, be compressed to the days-long window that Dream documented in Taiwan. The response window for defenders doesn't automatically compress at the same rate. Taiwan's Ministry of Digital Affairs indicated they completed their investigation — but the data had already left.

Taiwan's National Security Bureau reported an average of 2.63 million Chinese intrusion attempts a day against critical infrastructure in 2025, 6% above 2024 and more than double the 2023 rate. A Global Taiwan Institute analysis calculates about $75 million a year from the government's 2025–2028 national cybersecurity-development program; that is a program allocation, not a full accounting of every cyber-related expenditure.

What Comes Next

The Taiwan story isn't really a Taiwan story. It's a preview of a problem that exists everywhere institutions have credentialing systems, personnel databases, and network perimeters that were designed before autonomous AI agents were a plausible operational tool for an adversary.

The debate about frontier AI safety will continue. The case for export controls, usage monitoring, and capability evaluation of the most advanced models is real and not going away. But a threat actor that can run a capable open-weight model privately changes the enforcement problem: API policy alone cannot reach that deployment.

The evidence here is not that guardrails have solved cyber misuse. It is that they may shift attacker demand toward systems with less centralized control. That shift — combined with agents that can carry out a longer chain of work between human decisions — is the more concerning finding.

Sources

Bloomberg Law — Chinese Hackers Use DeepSeek to Boost Attacks, Researchers Say: https://news.bloomberglaw.com/tech-and-telecom-law/chinese-hackers-use-deepseek-to-boost-attacks-researchers-say

Dream Security — Inside a Multi-Agent AI Framework Used to Compromise Government Entities in Asia: https://www.dreamgroup.com/blog/inside-a-multi-agent-ai-framework-used-to-compromise-government-entities-in-asia

Taiwan Ministry of Digital Affairs, Administration for Cyber Security — Government response to the AI-assisted intrusion: https://moda.gov.tw/ACS/press/news/press/20394

Taiwan News — Taiwan confirms AI-assisted attack by foreign hackers on government systems: https://www.taiwannews.com.tw/en/news/6420706

Taiwan National Security Bureau — Analysis of Chinese cyber threats to Taiwan's critical infrastructure in 2025: https://www.nsb.gov.tw/en/assets/documents/%E6%96%B0%E8%81%9E%E7%A8%BF/9976f2e1-3a8a-4fa2-9a73-b0c80fca1f04.pdf

DeepSeek — Model card and MIT licensing information: https://fe-static.deepseek.com/chat/transparency/deepseek-v3.2-model-card-0414-EN.pdf