Researchers detail the growing use of AI in cyberattacks across many Chinese state-linked groups, primarily using open-weight models like Kimi K3 and DeepSeek
Chinese hackers are ramping up attacks after integrating DeepSeek and other open-source artificial intelligence models into their operations …
Context & Ripple Effects
The findings extend a documented progression from state actors using general-purpose AI services in 2025 to suspected Chinese operators deploying open-source AI agents in a compromise of Taiwanese government websites in July 2026. The salient change is the apparent spread of AI-assisted operations across multiple groups rather than a single reported tool.
They also sharpen the security implications of Chinese open-source models gaining global adoption, a development that had already put US policymakers and companies on alert. CrowdStrike's June assessment that Chinese entities dominated state-backed attacks on technology companies, particularly AI assets, supplies the strategic backdrop.
First-order effects
- Organizations targeted by Chinese state-linked groups face campaigns increasingly assisted by open-weight models such as DeepSeek and Kimi, broadening the set of operators able to apply AI to attack work.
- DeepSeek and Kimi face greater scrutiny over how broadly accessible model weights and developer tools can be repurposed in state-linked cyber operations.
Second-order effects
- Government network defenders and threat-intelligence teams must treat AI-agent-enabled activity as a repeatable operating pattern, not only as the isolated Taiwanese-government incident reported in August 2026.
- The report shifts pressure on US policymakers from controlling advanced computing access alone toward addressing the security consequences of widely distributed model access.
Third-order effects
- If use continues to spread across groups, dual-use AI governance will increasingly center on the trade-off between open model availability and safeguards against operational cyber abuse.
- Cyber competition may become less constrained by which state has exclusive access to a frontier service and more by which actors can adapt accessible models into reliable attack workflows.
The trend: Open-weight AI is becoming a geopolitical security issue because broad model access can diffuse cyber capabilities across state-linked operators.