Chinese Groups Hand Cyber Espionage Planning to AI Agents

Two China-linked crews have started using the AI-driven penetration tool ARTEX to run large-scale spying operations. Vapor Panda activated it on 17 October 2026 and struck more than 200 organisations across 14 countries. Planning agents alone consumed 1.4 billion tokens in a single campaign while humans only signed off on final steps.

Nineteen U.S. targets in pharma, semiconductors, defence, nuclear and finance were hit; confirmed breaches occurred at nine of them with the BLOODALCHEMY backdoor. Storm-0940, the second group, began using ARTEX in September and reached privileged cloud access in under three hours in several cases.

A separate operation against South Korean financial institutions stole personal data of roughly 67,000 people. Microsoft recorded 151,000 failed login attempts against 327 accounts in just five October days, peaking at 2,900 tries per minute. Earlier Chinese activity with Claude Code in 2025 already showed AI handling up to 90 % of the workload.

Based on information from cryptonews.net