Chinese Spies Turned AI Agents Loose on 200 Targets in 11 Days, Firing Off 1,500 Commands an Hour

A human hacker at the keyboard typically manages up to 40 commands an hour. The AI agents in a new Chinese espionage campaign can exceed 1,500, and in just 11 days they went after more than 200 organizations in at least 14 countries.

CrowdStrike published the findings on Thursday, blaming the China state backed group it calls Vapor Panda. The activity began on 17 October and is still running. Adam Meyers, who leads counter adversary operations at the company, called it "the first time that we're seeing an agentic adversary nation-state threat actor at this scale."

Ministries, chipmakers and a presidency

The target list reads like a map of what a state wants to know. It includes the foreign ministries of two Latin American countries, and likely a third, along with a Middle East interior ministry. One engagement focused on a single European country's foreign ministry, presidency, prime minister's office, and its defense, justice, finance and intelligence entities. Another hit 19 US organizations in pharmaceuticals, semiconductors, defense, nuclear and finance. Telecoms in the US, Belgium and the Philippines were compromised too.

How many victims actually fell depends on how you count. The report itself confirms post-exploitation activity at nine organizations, plus password spraying against at least 12 more. CrowdStrike separately told CyberScoop that about 70% of targets were either confirmed compromised or showed moderate confidence evidence of intrusion.

The machine grinds, the human steers

The tool is ARTEX, an agentic penetration testing framework that ran mainly on DeepSeek, plus a second commercial model CrowdStrike could not confirm. A main agent directs planner and worker agents, which share a graph of facts and goals. In one intrusion, the planning agents alone consumed about 1.4 billion input tokens. Requests went out as often as every 10 seconds.

People were still giving the orders. Transcripts show an operator typing instructions in Chinese, labeled "human instruction" and timestamped in China Standard Time, telling the agents to create web shells and extract domain admin credentials. At one pharmaceutical company, the operator told them to "find Windows machines in the domain without Falcon," using PRC red-team slang for CrowdStrike's own sensor.

The agents proved inventive once pointed at a target. At one US pharmaceutical firm, an agent chained an unsigned SAML assertion with an XXE flaw to reach the cloud Instance Metadata Service. That gave it a role able to issue admin commands to thousands of instances, and eventually an enterprise admin account.

At a Greek government entity, the operator fed the agent a mail server directory export from 2022, with keys likely never rotated. The agent forged an admin token, read mailboxes, and found its way inside using VPN configurations from a user's sent mail.

More than one group is using it

CrowdStrike had not seen Vapor Panda use AI-driven tooling before. The group is also not alone. In October, Microsoft attributed separate ARTEX activity to a group it tracks as Storm-0940, including a ConnectWise supply chain attack. The framework also turned up in the breaches of seven South Korean financial firms, though officials there said attribution to any country was impossible.

The wider count is climbing fast. CrowdStrike saw about 45 agentic adversary attacks in September and 126 in October by the time of its report. "We're scrambling because we're seeing so many of these agentic adversaries," Meyers said.

The advice is unglamorous: rotate signing and service keys after any exposure, including old backups and directory exports, enforce SAML signature validation, require IMDSv2, hunt for artx and artex markers, patch internet facing Linux appliances, and run EDR everywhere. A forgotten 2022 export was enough in Greece.

"It's not hopeless, but you've got to take action," Meyers said. "You can't put your head in the sand."

Some offers on this page may be paid placements or contain affiliate links.