Taiwanese cybersecurity firm warns that AI tools have more than doubled Chinese state-backed cyberattacks

State-backed hacking groups from China have more than doubled their attacks since they started using AI for routine tasks and malware development, according to Taiwanese security firm TeamT5 (via Bloomberg). Deepseek is especially popular among Chinese hackers "because it’s relatively powerful with very low cyber guardrails," said chief analyst Charles Li.

The group Grimfengxi used DeepSeek to write exploit code, while Huapi relied on a Chinese model likely to be DeepSeek. Teleboyi used the platform to collect IP addresses and map domains. ChatGPT played a role in at least one case. Security firm CyCraft found evidence that hackers used it to build a decryption module for a Signal database. A group called Slime22 also used Anthropic's Claude Code to move through the systems of a Taiwanese company, TeamT5 said.

A study by the UK AI Safety Institute found that the cyber capabilities of open models have jumped sharply. For fully autonomous attacks, they still trail Western frontier models like Claude Mythos by several months.

AI News Without the Hype – Curated by Humans

Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.