Nine months ago, Anthropic reported the disruption of an AI-orchestrated cyber espionage campaign in which a Chinese state-sponsored group had used Claude to execute 80-90% of tactical operations independently throughout the attack lifecycle.
Since then, a cluster of semi-autonomous cyberattacks by Chinese-speaking and suspected China-linked actors has emerged. Across these cases, AI agents have autonomously conducted tasks ranging from reconnaissance and exploit research to exploitation and exfiltration, in operations primarily targeting governments across Asia.
In this article, we compare five such intrusions, aiming to understand the tools, tactics, and objectives of these actors.
Suspected China-Nexus Actor Runs Claude Code and DeepSeek in Tandem Across Government and Financial Intrusions (Hunt.io – Jul 14, 2026)
Autonomous Hermes AI Agent Runs Unattended in Intrusion Against Thailand’s Ministry of Finance (Hunt.io – Jul 23, 2026)
Chinese-Speaking Actor knaithe Runs DeepSeek in Hermes Agent for Autonomous CVE Research and Exploitation (Unit 42 – Jul 30, 2026)
China-Nexus Actor Runs DeepSeek-Driven Autonomous Agent in Five-Day Proxyjacking Campaign (Jesta – Aug 3, 2026)
Multi-Agent AI Framework Built on Hermes and OpenClaw Compromises Government Entities in Taiwan (Dream – Aug 12, 2026)
Five patterns
All five operations were assembled from off-the-shelf parts. Every actor leveraged publicly available agent frameworks and either open-weight or mixed models rather than building an offensive AI stack from scratch. Hermes drove three campaigns (one of them in combination with OpenClaw), while DeepSeek provided the reasoning layer in three as well.
Where safeguards posed a barrier, operators found ways around them. They framed attacks as authorized security work or routed the most adversarial tasks to less-restricted models.
The Taiwan multi-agent campaign was framed as an ‘authorized penetration test.’
The four-country campaign fed Claude Code deceptive persona prompts so it would act as a sanctioned tester.
knaithe shipped a bundled “godmode” jailbreak skill, using Claude Code and Codex for connectivity checks and sending the actual offensive work to DeepSeek.
Autonomy increased speed and scale, but the most successful operations still relied on substantial human-built orchestration. Agents could automate reconnaissance, CVE research, and exploitation attempts, but greater impact appeared alongside more sophisticated systems around the model.
knaithe autonomously scanned hundreds of targets but failed because every candidate required authentication.
The proxyjacking agent ran 871 sessions across five days, but performed relatively simple tasks.
The two highest-impact campaigns used more sophisticated orchestration: a split-model pipeline in the four-country campaign and up to eight parallel agents in Taiwan.
Four of the five operations surfaced through the operators’ own exposed infrastructure. This creates an important selection effect: publicly documented cases may disproportionately reflect actors with weaker operational security.
The four-country campaign and the Thai ministry intrusion were found via unauthenticated open directories.
knaithe was exposed when its own agent started an HTTP file server in the operator’s home directory, dumping the entire workspace.
The Taiwan multi-agent campaign left a 160MB archive of 1,395 files.
Agents adapted when their initial approach failed. Detailed agent logs make this behavior unusually visible, showing agents reassessing their options and finding alternative paths when blocked.
knaithe’s agent switched from Langflow to n8n after judging it a more promising target for exploitation.
In the Taiwan campaign, agents responded to failed attack paths by searching public sources for alternative techniques and trying again.
Five standouts
The four-country campaign paired Claude Code for execution with DeepSeek-v4-pro for reasoning, allowing the operators to route adversarial reasoning through a less-restricted model while retaining Claude’s agentic capabilities. This combination produced confirmed compromises across three countries and scanned more than 5,890 government hosts across ten.
The Thai ministry intrusion came closest to a “fire-and-forget” agent. Hermes ran in auto-execution mode, with little apparent human intervention, to enumerate targets and escalate privileges against Thailand’s Ministry of Finance. However, the agent’s causal role remains unclear because the initial access vector is unknown.
knaithe showed how these capabilities can diffuse to individual operators. A lone opportunistic operator used DeepSeek through a Hermes agent over Telegram to automate targeting, CVE research, and exploitation attempts. Unlike the other actors, knaithe also targeted Chinese infrastructure.
The proxyjacking campaign was the objective outlier. Rather than espionage or data theft against governments, the agent attempted to turn compromised hosts into proxy infrastructure. It generated 871 sessions over five days, but the operation remained relatively low-complexity.
The Taiwan campaign had the most sophisticated orchestration. Its framework deployed up to eight sub-agents in parallel across twelve attack waves, adapting when attack paths failed and correcting mistakes. It also produced the greatest documented impact: 85 cracked credentials, 2,500+ personnel records, persistent access, and a pivot to Taiwan’s nuclear safety agency.
Conclusion
Taken together, these cases show that agentic cyber operations no longer require bespoke AI systems: publicly available models and frameworks can already automate substantial parts of an intrusion. But autonomy alone did not determine success. The most consequential operations combined capable models with more sophisticated orchestration, while simpler autonomous deployments mainly delivered speed and scale.