gcdRadar
live/Breaches & attacks/AIR-2026-1742
liveliveBreaches & attacks3 Confirmed exploitationAI

China-linked threat groups use AI agents to scale espionage attacks

LLM-based agent tooling

A China-nexus espionage group and separate Chinese-speaking operators used large language model agents to orchestrate attacks against over 200 organizations and educational institutions. The AI agents automated command execution and scaled operations based on human-defined goals.

why this severityConfirmed large-scale cyberattack campaign using AI agents.

first report
3 Nov 2026
last update
3 Nov 2026

Timeline · 1

  1. 3 Nov 2026AI agents scale and speed up Chinese-linked attacks

Sources · 1

News and write-ups

  1. 2026-11-03
    AI agents scale and speed up Chinese-linked attacks
    Help Net Security · helpnetsecurity.com/2026/11/03/ai-powered-cyberattacks-artex-cyberstrikeai

Titles and links belong to their publishers. The summary above is written by gcdRadar in its own words; data is CC BY-SA 4.0.

Classification

AI role
AI-enabled attack
categories
AI-assisted intrusion
severity
3 · Confirmed exploitation
targets
Individuals, Enterprise deployment
owasp llm top 10
no entry for these categories
mitre atlas
no technique for these categories
dates
happened 3 Nov 2026 · first reported 3 Nov 2026
origin
News & research feeds
record
confidence 0.90 · created 2026-11-04 00:07Z · updated 2026-11-04 00:07Z

Lane, AI role, categories and severity come from the classifier; the OWASP and ATLAS rows are derived from the categories. How these are assigned

Copy a brief

This record as a short Markdown brief, for a ticket, a chat or a coding agent.

the brief as text
# China-linked threat groups use AI agents to scale espionage attacks

https://gcdradar.vercel.app/incidents/china-linked-threat-groups-use-ai-agents-to-scale-espionage · AIR-2026-1742 · live

- Lane: Breaches & attacks
- Severity: 3 (Confirmed exploitation): Confirmed large-scale cyberattack campaign using AI agents.
- Fix status: No fix needed
- First reported: 2026-11-03
- AI role: AI-enabled attack
- Products: LLM-based agent tooling

## Summary

A China-nexus espionage group and separate Chinese-speaking operators used large language model agents to orchestrate attacks against over 200 organizations and educational institutions. The AI agents automated command execution and scaled operations based on human-defined goals.

## What to do

No action recorded; read the sources below and the vendor's advisory.

## Latest updates

- 2026-11-03: AI agents scale and speed up Chinese-linked attacks (https://helpnetsecurity.com/2026/11/03/ai-powered-cyberattacks-artex-cyberstrikeai)

## Sources

- 2026-11-03 Help Net Security: AI agents scale and speed up Chinese-linked attacks https://helpnetsecurity.com/2026/11/03/ai-powered-cyberattacks-artex-cyberstrikeai

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.

Related

  1. live
    AI
  2. live
    Cursor AI Aur0ra ransomware operators used AI coding agents for intrusion workflows

    Breaches & attacks · Real loss · since Aug 2026 (approx.)

    AI
  3. closed
    Threat Actor Used AI to Plan and Execute Cybercrime Activities

    Breaches & attacks · Exploited · since 21 Oct 2026

    AI
  4. closed
    AI
  5. live
    ArcticRAT ArcticRAT Cybercrime Gang Profiles Victim Finances With AI

    Breaches & attacks · Exploited · since 13 Nov 2026

    AI
  6. live
    Credential stuffing campaign spoofs consumer AI agent traffic

    Breaches & attacks · Exploited · since Oct 2026 (approx.)

    AI