[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f_Z6fG4qV_iPPz8rGhfNxKQA7_LlawFDih9gUVx006Ng":3},{"article":4,"iocs":53,"watch_terms":54,"solutions":55,"lesson":144},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"33978ee7-4155-4d3a-9e18-d0083c556deb","Hackers Use DeepSeek and GLM AI Agents to Breach 10 Organizations in Autonomous Cyberattacks","hackers-use-deepseek-and-glm-ai-agents-to-breach-10-organizations-in-autonomous-1e7126","Chinese-speaking hackers have used AI agents powered by DeepSeek and Zhipu GLM to break into 10 organizations with very little human effort. The campaign ran in August and September 2026 and covered 25 operations against at least 19 targets. It shows how quickly autonomous AI cyberattacks are moving from theory into daily use. The attackers […] The post Hackers Use DeepSeek and GLM AI Agents to Breach 10 Organizations in Autonomous Cyberattacks appeared first on Cyber Security News.","Chinese-speaking hackers have autonomously breached 10 organizations using AI agents powered by DeepSeek and Zhipu GLM, with minimal human effort. The campaign, which ran in August and September 2026, utilized an open-source penetration testing framework called Cairn, connecting it to AI models to plan and execute attacks. Targets included organizations in semiconductor manufacturing, U.S. defense policy, and civil society.","Hackers used AI agents powered by DeepSeek and GLM to breach 10 organizations autonomously.","https:\u002F\u002Fcybersecuritynews.com\u002Fdeepseek-and-glm-ai-agents\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FHackers-Use-DeepSeek-and-GLM-AI-Agents-to-Breach-10-Organizations-in-Autonomous-Cyberattacks.webp","2026-11-13T11:56:24+00:00","2026-11-13T12:00:36.324945+00:00",8,[17,20,23,25,27],{"name":18,"type":19},"Chinese-speaking hackers","threat_actor",{"name":21,"type":22},"DeepSeek","product",{"name":24,"type":22},"Zhipu GLM",{"name":26,"type":22},"Cairn",{"name":28,"type":29},"AI agents","technology","6cbdd207-aaa1-4176-9534-e156b125e917",{"id":30,"icon":32,"name":33,"slug":34},null,"Nation-state","nation-state",[36,41,43,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":42},{"id":30,"icon":32,"name":33,"slug":34},{"category":44},{"id":45,"icon":32,"name":46,"slug":47},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[],[21,24,26],{"controls":56,"vendors":137},[57,86,115],{"slug":58,"name":59,"problem":60,"products":61},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[62,70,78],{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":87,"name":88,"problem":89,"products":90},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"sentinelone","SentinelOne","\u002Fvendor-logos\u002Fsentinelone.png","singularity-endpoint","Singularity Endpoint","https:\u002F\u002Fwww.sentinelone.com\u002Fplatform\u002Fendpoint-security\u002F","Endpoint protection and detection with automated response and rollback.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"slug":116,"name":117,"problem":118,"products":119},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[120,121,129],{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"corelight","Corelight","\u002Fvendor-logos\u002Fcorelight.png","open-ndr","Corelight Open NDR","https:\u002F\u002Fcorelight.com\u002Fplatform\u002F","Network detection and response based on Zeek and Suricata.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"darktrace","Darktrace","\u002Fvendor-logos\u002Fdarktrace.png","darktrace-network","Darktrace \u002F NETWORK","https:\u002F\u002Fwww.darktrace.com\u002Fproducts\u002Fhybrid-network","Network detection and response based on learning normal behaviour.",[138],{"slug":139,"name":140,"logo_path":141,"roles":142},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png",[143],"reported_by",{"slug":145,"title":146,"body":147,"framework_refs":148,"framework_notes":154},"ai-powered-autonomous-attacks-breach-10-organizations-with-minimal-human-effort","AI-Powered Autonomous Attacks Breach 10 Organizations With Minimal Human Effort","Chinese-speaking threat actors combined open-source penetration testing tools with large language model AI agents (DeepSeek and Zhipu GLM) to autonomously plan, execute, and complete intrusions across 10 organizations — including targets in semiconductor manufacturing and U.S. defense policy — with little human oversight. The root issue is that defenders have not yet adapted detection and response capabilities to the speed and scale at which AI-driven attacks can operate, leaving traditional alert thresholds and analyst-paced triage dangerously inadequate. When an attacker can delegate reconnaissance, exploitation, and lateral movement to an autonomous agent, the window between initial access and deep compromise shrinks dramatically. This matters because high-value sectors like defense and semiconductors face nation-state-grade adversaries who now have a scalable, low-cost force multiplier that outpaces conventional security operations.",[149,150,151,152,153],"MITRE ATT&CK T1059: Command and Scripting Interpreter","CIS Control 7: Continuous Vulnerability Management (v8)","CIS Control 13: Network Monitoring and Defense (v8)","NIST SP 800-53 SI-4: System Monitoring","NIS2 Article 21(2)(f)",{"NIS2 Article 21(2)(f)":155,"NIST SP 800-53 SI-4: System Monitoring":156,"CIS Control 13: Network Monitoring and Defense (v8)":157,"MITRE ATT&CK T1059: Command and Scripting Interpreter":158,"CIS Control 7: Continuous Vulnerability Management (v8)":159},"NIS2 Article 21(2)(f) requires organizations to assess the effectiveness of their security measures, and regular effectiveness testing would have revealed that existing detection controls were insufficient against the speed of AI-driven autonomous attacks.","SI-4 requires continuous monitoring of information systems for indicators of attack; the autonomous, multi-step intrusion chain executed by the AI agents would have generated observable indicators that compliant monitoring should have surfaced in near-real time.","CIS Control 13 requires monitoring network traffic for anomalous behavior — the rapid, sequential reconnaissance and exploitation performed by AI agents would have produced detectable patterns that tuned network monitoring could have flagged.","The Cairn framework's AI agents executed attack steps programmatically through scripted commands, which T1059 covers and which behavioral monitoring of script execution would have detected.","AI agents exploit known, unpatched vulnerabilities at machine speed; a continuous vulnerability management program prioritizing high-risk exposed assets would have reduced the attack surface available to the autonomous campaign."]