Chinese state-affiliated hackers and independent operators are increasingly turning to open-weight AI models like DeepSeek, Qwen, and Kimi to automate cyberattacks, according to threat intelligence reports from August 2026. The shift reveals a critical asymmetry: attackers are exploiting the same models that defensive teams are blocked from using by stricter guardrails on Western frontier AI systems.

Why Are Hackers Preferring Chinese AI Models?

The answer boils down to three factors: capability, cost, and permissiveness. DeepSeek has emerged as the preferred choice for offensive operators because it delivers strong performance on reasoning and coding tasks while imposing fewer restrictions on potentially harmful outputs compared to OpenAI's GPT or Anthropic's Claude. Charles Li, chief analyst at TeamT5, a Taiwanese threat intelligence firm, explained the appeal directly.

"DeepSeek is the AI of choice for Chinese hackers because it's relatively powerful with very low cyber guardrails," said Charles Li.

Charles Li, Chief Analyst at TeamT5

Open-weight models, which are publicly released and can be run locally, also eliminate per-token billing costs that accumulate during high-volume scanning campaigns. For attackers running thousands of reconnaissance queries or exploit attempts, this cost advantage is substantial.

What Specific Attacks Have Been Documented?

In August 2026, two major threat research organizations published detailed findings on active exploitation campaigns. TeamT5 reported that Chinese state-affiliated cybergroups more than doubled their attack volume after integrating AI into their workflows. The group Grimfengxi was tied to DeepSeek-written exploits, while Huapi targeted a Taiwanese company's email system using a Chinese AI model.

Palo Alto Networks Unit 42 documented a more granular case study involving an operator using the handle "knaithe." This individual deployed Hermes Agent, an open-source autonomous tool, paired with DeepSeek to target internet-exposed systems. The operator used FOFA, a search engine for exposed assets, to identify vulnerable targets and then launched automated attacks without further human intervention.

The scale was significant: Unit 42 identified one campaign chain targeting n8n, a low-code automation platform, that discovered over 64,000 exposed instances globally. Another chain targeted Langflow, identifying 84 exposed servers. While most attacks failed against hardened targets, 14 succeeded by exploiting known, unpatched vulnerabilities.

How Are Defenders Being Disadvantaged?

The asymmetry cuts both ways. While attackers route through models with minimal restrictions, defensive teams face the opposite problem. In July 2026, explainx.ai documented cases where frontier AI models refused to help security teams generate patches or validate fixes for the same vulnerability classes that attackers were exploiting. Kimi K3 and self-hosted GLM 5.2 did not impose these restrictions, but most organizations lack access to or comfort deploying these alternatives.

This creates a tempo disadvantage: attackers compress exploitation speed for known vulnerabilities using unrestricted models, while defenders lose time navigating guardrails on the same tasks. As Unit 42's Andy Piazza noted, patching delays become existential when AI accelerates the attack timeline.

Steps to Strengthen Your Organization Against AI-Powered Attacks

• Patch Internet-Exposed Tools First: Prioritize patching low-code platforms like n8n and Langflow, workflow engines, and CI/CD systems that appear in public asset searches. These are the surfaces that autonomous attack loops target first.
• Assume Exposure Management at Scale: If a system is searchable via FOFA or similar tools, assume it will be discovered and chained into automated attack sequences. Run continuous exposure management as a core security practice.
• Separate Research Models from Production Keys: Deploy self-hosted or contractually scoped AI models for incident response and patch validation work. Do not route defensive security tasks through frontier APIs with restrictive guardrails; instead, use models and harnesses your team controls.
• Implement Agent Tool Permissions: If you deploy AI agents for any purpose, enforce strict tool permissions and sandbox boundaries. Assume indirect prompt injection and agent tool abuse are in scope for any internet-facing automation.
• Document Your Guardrail Policy: Create clear internal guidance on which models your team uses for which tasks. If frontier APIs refuse defensive work, establish approved alternatives for IR and security engineering workflows.

What Other Chinese Models Are Being Used in Attacks?

While DeepSeek dominates the offensive toolkit, the knaithe case study revealed that attackers are testing multiple alternatives. The operator configured Qwen, GLM, Kimi, and MiniMax for adjacent tasks, and tested Claude Code and Codex on related work. However, the autonomous attack phase consistently ran on Hermes Agent paired with DeepSeek.

This suggests that attackers are building redundancy into their stacks. If one model becomes unavailable or adds restrictions, they have fallback options ready. The diversity of models being tested also indicates that the problem is not unique to DeepSeek; it reflects a broader category of models with weaker cyber guardrails.

What Does This Mean for AI Safety and Liability?

The August 2026 findings reinforce a growing debate about responsibility. A satirical website called Felony Bench scored Anthropic and OpenAI equally on documented incidents where AI agents inadvertently compromised third parties. The resulting Hacker News discussion became the most substantive public debate yet on who bears liability when an agentic loop breaks the law.

The core tension is this: should responsibility fall on model providers for releasing unrestricted versions, on framework developers for building autonomous tools, on operators for deploying them, or on defenders for failing to patch? The August reports suggest that the answer is all of the above, but the asymmetry in guardrails means that defenders currently bear the heaviest burden.

On a separate front, DeepSeek released deepseek-v4-flash-vision-exp on August 21, 2026, an experimental multimodal model that matches DeepSeek-V4-Flash on text and reasoning tasks while making significant gains on multimodal agent benchmarks, approaching performance levels near Anthropic's Claude Opus 4.8. This capability expansion may further accelerate adoption among both legitimate users and attackers.

The core lesson from August 2026 is not that DeepSeek is malware or that open-weight models should be banned. Rather, it is that the cheapest capable model with the fewest refusals becomes the offensive default, while defenders still hit guardrail walls on frontier APIs for the same class of work. Organizations that understand this asymmetry and build defensive infrastructure accordingly will be better positioned to respond.