Chinese Hackers Scale Attacks With DeepSeek and Low Guardrails

August 2026 brought overlapping reports from TeamT5 (Taiwanese threat intelligence) and Palo Alto Networks Unit 42 on the same uncomfortable pattern: offensive operators — including state-affiliated Chinese groups and independent actors — are scaling cyber campaigns by plugging DeepSeek and open agent harnesses into reconnaissance, exploit selection, and autonomous attack loops. TeamT5 told outlets including the Straits Times that affected groups more than doubled attack volume after AI delegation; Unit 42 documented operator "knaithe" running Hermes Agent with DeepSeek against 460 systems, with successes clustering on unpatched, publicly known CVEs.

If you build or deploy AI agents, the story is not "DeepSeek is malware." It is that the cheapest capable model with the fewest refusals becomes the offensive default — while defenders still hit guardrail walls on frontier APIs for the same class of work.

TL;DR — what people are asking

TeamT5: state groups and the DeepSeek default

TeamT5's August reporting, amplified by Straits Times, describes Chinese state-affiliated cybergroups adopting AI across attack stages:

• Reconnaissance and vulnerability analysis
• Exploit code generation — group Grimfengxi tied to DeepSeek-written exploits
• Lateral movement support against foreign companies and institutions

Charles Li, chief analyst at TeamT5, summarized the model choice: "DeepSeek is the AI of choice for Chinese hackers because it's relatively powerful with very low cyber guardrails." Cost and customization matter too — open weights and cheap inference beat per-token frontier billing when you are running high-volume scanning.

A separate line in the same reporting: group Huapi used a Chinese AI model (likely DeepSeek) against a Taiwanese company's email system — illustrating that the trend is not abstract benchmark chatter but active regional targeting.

Unit 42: Hermes Agent + DeepSeek in one operator workflow

Unit 42's July 30, 2026 case study adds operational detail the macro statistics omit.

Operator: Chinese-speaking individual knaithe / KnYuan, Zhuhai — not necessarily a formal state unit, but demonstrating tooling any motivated actor can replicate.

Stack: Hermes Agent as orchestrator, DeepSeek as reasoning model, instructions via Telegram, target discovery via FOFA (internet-exposed asset search), exploits pulled from public GitHub PoCs.

Observed autonomous loop:

1. Survey ~10 product families for trending critical CVEs.
2. Download public exploit code.
3. Launch attacks without further human input for that phase.

One recovered session targeted Langflow (CVE-2026-33017, CVSS 9.8) — 84 exposed servers identified, one potentially vulnerable, attack failed on config. Another chain targeted n8n at scale (FOFA: 64,000+ exposed instances globally) combining CVE-2026-21858 (10.0) and CVE-2025-68613 (9.9).

Outcome: Autonomous path did not fully compromise intended hardened targets; 14 successes elsewhere tied to known, patchable flaws. Unit 42's Andy Piazza framed the shift: AI compresses exploitation speed for known vulnerabilities — patching delays become existential.

The operator also configured Qwen, GLM, Kimi, MiniMax, and tested Claude Code and Codex on adjacent tasks — the autonomous attack phase, however, ran on Hermes + DeepSeek.

The guardrail asymmetry builders already feel

explainx.ai covered the mirror image in July: American frontier models refusing security-adjacent fix generation while Kimi K3 and self-hosted GLM 5.2 did not — see AI cyber guardrails block US defenders.

August's offensive reporting is the other shoe: attackers route through least-refusal stacks. Defenders routing through most-refusal APIs lose tempo on the same CVE classes Unit 42 highlights.

That is not an argument for removing all guardrails. It is an argument for scoped defensive infrastructure:

• Self-hosted or contractually scoped models for IR and patch validation
• Destructive command guards and sandbox boundaries on your own agents — patterns in DCG for coding agents
• Assume indirect prompt injection and agent tool abuse are in scope for any internet-facing automation

What people are asking about DeepSeek specifically

"Should I stop using DeepSeek in my product?" — No universal ban follows from adversary adoption alone; assess your threat model. If you expose agent tools to untrusted input, model choice matters less than tool permissions and network egress.

"Is Hermes Agent the problem?" — Hermes is a general open harness — same category as OpenClaw and Claude Code. Offense comes from operator intent + exposed services, not the repo name.

"Does this change OpenAI's Critical cyber bar?" — It reinforces why Astra / Preparedness treats autonomous cross-system offense as a tier change — and why Wiz Red Agent-style evaluations matter for your CI/CD surface.

Honest limitations

• Attribution noise: TeamT5 discusses state-affiliated groups; Unit 42's knaithe case is a single operator — do not merge into one campaign.
• Model ID certainty: TeamT5 notes it is not always possible to identify which model ran a given step; DeepSeek is described as the dominant choice, not the exclusive one.
• Impact inflation: Headlines citing 460 systems overstate breach counts — Unit 42 separates scan volume from successful compromise.
• CVE numbering: Some CVE IDs in secondary reporting may reflect synthetic or forward-dated examples in vendor timelines — verify against NVD before prioritizing patches.

Actionable checklist for agent builders

1. Patch internet-exposed CI, workflow, and low-code tools first — n8n/Langflow-class surfaces show up in Unit 42's autonomous selection logic.
2. Run exposure management assuming FOFA + agent loops — if it is searchable, assume it will be chained.
3. Separate research agents from production keys — follow Skillspector-style skill scanning on anything that executes shell or network tools.
4. Document guardrail policy for your team — if frontier APIs refuse defensive work, route IR to models and harnesses you control, as in the July Kimi/GLM thread.

Related on explainx.ai

• AI cyber guardrails block US defenders — Kimi K3 vs Fable/Codex
• OpenAI Astra Critical cyber capability framework
• Wiz Red Agent — autonomous offensive tool vs live targets
• Four AI agent security incidents — pattern not coincidence
• Hermes Agent vs OpenClaw — harness comparison
• DeepSeek V4 pricing vs GPT-5.6 — builder economics
• China AI playbook — open weights and cheap compute
• What is indirect prompt injection?

Sources: Straits Times on TeamT5 reporting, Forbes and Help Net Security on Unit 42's July 30, 2026 knaithe case, Infosecurity Magazine. CVE details and campaign statistics are accurate as of August 25, 2026 — verify against Unit 42's full report and your own patch status before prioritizing remediation.