Chinese Actor Weaponizes Deepseek AI Agent to Attack Security Firm
Chinese actor weaponizes DeepSeek AI agent to attack security firm and compromise 1,200+ hosts.
Researchers at Jesta discovered a weaponized DeepSeek AI agent deployed by a Chinese threat actor targeting their organization and potentially over 1,200 other hosts. The agent was configured to conduct proxyjacking and facilitate further attacks. This represents a notable escalation in the use of large language models and AI systems as attack vectors by state-sponsored groups.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Jesta?
Get an email when a new story names Jesta, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA Chinese threat actor weaponized a DeepSeek AI agent — configuring it to conduct proxyjacking and launch further attacks against a security firm and over 1,200 other hosts. This incident highlights a dangerous escalation: AI systems, if not rigorously sandboxed and monitored, can be repurposed as offensive tools by sophisticated adversaries. The root cause lies in insufficient configuration controls and monitoring around AI agent deployments, allowing malicious actors to exploit the trusted and capable nature of LLM-based systems. As state-sponsored groups increasingly weaponize AI, organizations that adopt AI agents without hardened controls become unwitting attack surfaces.
What helps against this
How we list vendors- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
- AI application security
Prompt injection, data leaks through AI tools and unapproved AI use get caught.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — DeepSeek AI Agent (weaponized)