Chinese open-weight AI models like DeepSeek are rapidly becoming the default choice for offensive cyber operations, according to threat intelligence reports from August 2026. Researchers at TeamT5 (a Taiwanese threat intelligence firm) and Palo Alto Networks Unit 42 documented that attackers are scaling automated cyber campaigns by integrating DeepSeek and other open-source models into reconnaissance loops, exploit selection, and autonomous attack workflows. The shift reflects a fundamental asymmetry in AI safety: the cheapest capable models with the fewest refusals become the offensive default, while defenders struggle with guardrails that block the same defensive work.

Why Are Hackers Choosing Chinese Models Over Western Alternatives?

The appeal of DeepSeek and similar Chinese open-weight models boils down to three factors: performance, cost, and permissiveness. Charles Li, chief analyst at TeamT5, explained the calculus directly: "DeepSeek is the AI of choice for Chinese hackers because it's relatively powerful with very low cyber guardrails." Open-weight models eliminate per-token billing constraints that make high-volume scanning expensive on frontier APIs like OpenAI's GPT or Anthropic's Claude. More importantly, these models impose fewer restrictions on requests related to cybersecurity tasks, allowing attackers to generate exploit code, identify vulnerabilities, and plan lateral movement without hitting refusal walls.

TeamT5's August reporting, amplified by the Straits Times, documented Chinese state-affiliated cybergroups adopting AI across multiple attack stages. Group Grimfengxi was tied to DeepSeek-written exploits, while group Huapi used a Chinese AI model against a Taiwanese company's email system. The trend is not abstract benchmark chatter but active regional targeting with real operational impact.

How Are Attackers Using These Models in Practice?

Unit 42's case study of an operator known as "knaithe" provides the most detailed operational picture. The attacker combined Hermes Agent (an open-source orchestration framework) with DeepSeek as the reasoning engine, receiving instructions via Telegram and discovering targets through FOFA, a search engine for internet-exposed assets. The workflow was largely autonomous: the system would survey product families for trending critical vulnerabilities, download public exploit code from GitHub, and launch attacks without further human input.

One recovered session targeted Langflow, identifying 84 exposed servers and attempting exploitation of CVE-2026-33017 (a critical flaw with a severity score of 9.8 out of 10). Another chain targeted n8n, a workflow automation tool, combining two critical vulnerabilities (CVE-2026-21858 and CVE-2025-68613) against more than 64,000 globally exposed instances. While the autonomous phase did not fully compromise hardened targets, 14 successful breaches elsewhere exploited known, patchable flaws. Unit 42 analyst Andy Piazza noted the strategic implication: "AI compresses exploitation speed for known vulnerabilities; patching delays become existential".

Which Chinese Models Are Being Used in Attacks?

While DeepSeek emerged as the dominant choice, the attacker tested multiple Chinese open-weight models for different tasks:

• DeepSeek: Primary model for autonomous attack orchestration and exploit generation
• Qwen: Tested for adjacent offensive tasks alongside the main attack loop
• GLM (ChatGLM): Evaluated for vulnerability analysis and lateral movement planning
• Kimi: Assessed for reconnaissance and target profiling
• MiniMax: Configured for supplementary offensive workflows

The operator also tested Claude Code and Codex on adjacent tasks, but the autonomous attack phase consistently ran on Hermes plus DeepSeek. This suggests that while attackers experiment with multiple models, they converge on the combination that balances capability with permissiveness.

What Does This Mean for Defenders?

The August offensive findings mirror a defensive problem documented in July: American frontier models refuse security-adjacent work like fix generation, while models like Kimi K3 and self-hosted GLM 5.2 do not. This creates a tempo disadvantage for defenders. Attackers route through least-refusal stacks while defenders routing through most-refusal APIs lose speed on the same vulnerability classes that Unit 42 highlights in active campaigns.

The solution is not to ban open-weight models but to build scoped defensive infrastructure. Organizations should consider these practical steps:

• Self-Hosted Models for IR: Deploy self-hosted or contractually scoped models for incident response and patch validation, avoiding guardrails that block defensive work
• Agent Tool Restrictions: Implement destructive command guards and sandbox boundaries on your own agents, following patterns used in defensive coding agent frameworks
• Exposure Management: Assume indirect prompt injection and agent tool abuse are in scope for any internet-facing automation, and patch internet-exposed CI/CD, workflow, and low-code tools first
• Guardrail Documentation: Document guardrail policy for your team so that if frontier APIs refuse defensive work, your team knows to route incident response to models and harnesses you control

Unit 42 emphasized that the problem is not DeepSeek itself or Hermes Agent as a framework. Both are general-purpose tools. The risk comes from operator intent combined with exposed services and weak network segmentation. A model choice matters less than tool permissions and network egress controls.

What Are the Attribution Caveats?

Several important limitations apply to these findings. TeamT5 discusses state-affiliated groups while Unit 42's knaithe case is a single operator; these should not be merged into one unified campaign. Model identification is also uncertain; TeamT5 notes it is not always possible to identify which model ran a given step, though DeepSeek is described as the dominant choice, not the exclusive one. Headlines citing 460 systems overstate breach counts; Unit 42 separates scan volume from successful compromise. Some CVE identifiers in secondary reporting may reflect synthetic or forward-dated examples in vendor timelines, so organizations should verify against the National Vulnerability Database before prioritizing patches.

The core takeaway is straightforward: open-weight models with permissive guardrails have become the offensive default because they are cheap, capable, and unrestricted. Defenders must either match that permissiveness with self-hosted infrastructure or accept a speed disadvantage on the same vulnerability classes that attackers are actively exploiting at scale.