Hackers Let DeepSeek Agents Run the Break-Ins

CrowdStrike said on October 29, 2026 that a China-linked group it calls VAPOR PANDA used ARTEX, an open-source framework of software agents, against more than 200 organizations in at least 14 countries over 11 days starting October 17. CrowdStrike says the agents ran mostly on the Chinese model DeepSeek, with a second commercial model it could not confirm, and that recovered transcripts show an operator giving instructions in Chinese and stepping in only at decision points. It confirmed break-ins at nine organizations and password attacks on at least 12 more; the targets included foreign ministries, drug makers and telecom companies.