Vals AI's CyberOffense ranges put Claude Opus 5.5 first at 77.1%, with open-weight DeepSeek V4.1 Flash matching GPT-6 Sol Daybreak on the Windows network range at about a tenth of the cost
Vals AI's CyberOffense benchmark, updated November 10, runs models through three ranges with the open-source Pi agent, a 500-million-token budget and a 48-hour limit: Nova, an Active Directory network with 21 objectives; Lighthouse, with 31 objectives; and Watershed, a simulated AWS environment whose scores are marked provisional. Its three-range averages: Claude Opus 5.5 77.1%, GPT-6 Sol Daybreak 65.9%, DeepSeek V4.1 Flash 1017 54.8%, Kimi K3.1 Pro 53.8%, Meta Wonder 47.2%, Grok 4.7 42.3%, Kimi K3 25.0%, GLM 5.3 Flash 18.3%. On Nova, DeepSeek scored 16.3 of 21 against Daybreak's 15.7, at about $2 a run against about $22. Vals writes: "Once a model's weights are public, no provider can monitor or stop how it is used." Earlier press accounts carry different figures that do not match the live page.
Malbear Labs says a jailbroken DeepSeek Flash agent ran more than two weeks of largely unsupervised intrusion against a European telecom provider and organisations it hosts
From more than 70 session transcripts in an exposed attacker directory, Malbear Labs says the agent entered through a Cisco BroadWorks XSP flaw, CVE-2026-20320, and moved laterally with older CVEs while a Chinese-speaking operator was present for only a few messages at a time. The telecom is not named; Malbear says millions of patient records were accessed through a database with default credentials, which no other party has confirmed.
Check Point finds 1,608 live ARTEX panels, and says one operator switched to more permissive Chinese models when Anthropic's Opus 5.5 hit guardrails
Check Point Research found 2,557 systems hosting or having hosted ARTEX panels, 1,608 of them live; exposed databases showed operators setting goals with little further prompting, mostly on Chinese models led by the DeepSeek Flash family, in campaigns that took more than 300 Apple code-signing certificates and more than 190,000 game-account credentials. It saw guardrails hit only on Anthropic's Opus 5.5, after which the actor moved to more permissive Chinese models.
Acronis says one operator in Taiwan ran a mesh of 12 AI agents against hundreds of organisations, reaching Taipei emergency-service records
Acronis's Threat Research Unit says a single individual, whom it places in Hualien City with high confidence, ran a 12-agent platform it calls BOSSAI against hundreds of organisations in eleven countries, with confirmed access or exfiltration at roughly ten targets in three countries, among them a Taipei fire-department patient-care records platform and case records from a city 119 dispatch system. The attack agents mainly ran an abliterated DeepSeek-V4 variant, with Grok 4.5 and MiniMax M3 used for infrastructure work.
CrowdStrike names a China-nexus actor, VAPOR PANDA, running the ARTEX agent framework against more than 200 organisations in 11 days
CrowdStrike says that beginning October 17 VAPOR PANDA used ARTEX "against more than 200 distinct organizations worldwide" in at least 14 countries over an 11-day window, "primarily with the Chinese-origin DeepSeek LLM" plus a second commercial model it could not confirm, with one intrusion consuming "on the order of 1.4 billion input tokens". It confirmed post-exploitation at nine organisations, including deployment of the BLOODALCHEMY backdoor, and says recovered transcripts show a human operator issuing instructions in Chinese.
A scan of 7.25 million public Gitee repositories finds 26,400 working cloud and AI credentials, thousands of them AI API keys
The Hacker News reports that researcher Ben Zimmermann, working with MongoDB's Kingfisher team, found 26,400 valid credentials in public repositories on the Chinese code host, among them 9,473 Alibaba Cloud key pairs, 3,170 DeepSeek keys, 1,489 Zhipu keys and 1,348 OpenAI keys. He had not confirmed that any had been revoked.
Dream says a suspected China-nexus actor chained the PHP2Shell flaws with a kernel bug to root 25 PAN-OS firewall and management servers, with Claude Code in its attack infrastructure
Dream says an attacker used "a custom, non-public build" of the PHP2Shell exploit chain (CVE-2026-109618 and CVE-2026-109619), paired with the Fragnesia kernel privilege escalation (CVE-2026-46300), to root 25 PAN-OS firewall and management servers in the US, Japan, Taiwan and South Korea. In a US government-affiliated environment, the attacker zeroed in on three servers: two firewalls and an internal firewall management server reached through a reverse SSH tunnel. Dream found Claude Code installed on the attack infrastructure and an AI offensive platform, aiscan, configured with DeepSeek and Kimi models. It says the code's structure and style across about 40 scripts "suggest AI-assisted development" but that it has no direct evidence that AI tools wrote the exploit or scripts.
F5 adds ten models to its adversarial-input leaderboard and states what the score does not cover
F5 Labs says ten models entered its CASI leaderboard in October, giving GPT-6 Luna 93.52, Grok 4.7 (high) 93.46 — xAI's highest result in a monthly run since February — GPT-6 Astra 89.62 and GPT-6 Sol 88.22, and publishing no score for the other six, among them Claude Opus 5.5, Claude Fable 5.1, Gemini 3.8 Flash, GLM-5.3 Flash and DeepSeek V4.1 Flash. F5 states the scope limit itself: "CASI measures how a model responds to adversarial input. It does not measure the connectors, shared computers, and permission models built around that model in production."
DHS ordered DeepSeek products excluded from federal civilian procurement and removed from agency systems
A notice in the Federal Register of October 20, 2026 - "Notice of Order Regarding Exclusion and Removal of DeepSeek Products From Federal Civilian Executive Branch Information Technology Systems and Procurements", signed by DHS General Counsel James H. Percival II - records an order issued under "the authority granted by the Federal Acquisition Supply Chain Security Act of 2018, 41 U.S.C. 1321-1328" for the "exclusion of information technology products and services developed by Hangzhou DeepSeek Artificial Intelligence Co., Ltd (DeepSeek), to include affiliated entities" from federal civilian agency procurements, and for the "removal of all DeepSeek and DeepSeek-affiliate products, and third-party products and services developed using DeepSeek implementations, from civilian agency information technology". The notice says the order came "following review of the Federal Acquisition Security Council Recommendation and affiliated evidence" without describing that evidence, states no effective date or compliance deadline in its own text - the signed order sits in an appendix reproduced as images - and gives the "FASCSA Order Implementation Team CISA Cybersecurity Division" as the implementation contact.
Zscaler puts a figure on the ARTEX campaign against Korean financial firms: personal data on about 67,000 people
Zscaler ThreatLabz attributes, with moderate confidence, a campaign against peripheral web applications of multiple South Korean financial firms to a financially motivated, Chinese-speaking actor using ARTEX, "an open source agentic penetration testing framework developed in China," configured with DeepSeek v4.1-flash and supplemented by GLM-5.3 and Grok 4.6. It says the actor exfiltrated data on about 67,000 people and used Claude Code sessions to plan monetisation, and that after the developer made the project closed source, "previously downloaded copies and forks may remain available."
CrowdStrike says the operator behind the South Korean bank intrusions ran ARTEX on DeepSeek and worked through Claude Code
CrowdStrike Intelligence, in a report published October 7 under Ashley Campion's name, describes “a recently released open-source agentic penetration testing (pentesting) tool developed in China” — ARTEX — used against South Korean financial organisations from late September to early October in a campaign that “resulted in exfiltrated data.” The instance examined “used DeepSeek v4.1-flash as the primary LLM backend,” likely reached through the API proxy or reseller xcai[.]pro, and the actor “supplemented this LLM with GLM-5.3 (Zhipu AI) and Grok 4.6 for additional Claude Code sessions.” Open directories on 38.244.50[.]120 and on a Hong Kong IP held “Claude Code session histories, ARTEX configuration files, and Claude memory files,” including a Chinese-language pentesting prompt; in one session the actor asked Claude where stolen Korean breach data is typically sold and for help finding Korean Telegram data-sales groups, and in another asked it to write a security-researcher résumé whose personal details, including a Guangdong location, CrowdStrike says “likely belong” to the ARTEX operator while “currently available information cannot definitively associate these details with the threat actor.” The actor is “likely a Chinese speaker and financially motivated” — “This assessment is made with moderate confidence” — and is tied to no named adversary. CrowdStrike names no victim and says the number of affected organisations is unconfirmed, citing industry reporting for a breached loan-progress inquiry service used by financial brokers at one bank and an employee mobile work-support system at another.
Korean investigators name ARTEX, a Chinese-language autonomous penetration-testing tool, in the run of bank breaches (via The Korea Times)
The Korea Times reports that “investigators reportedly found traces of an AI-powered tool known as ARTEX” in the run of attacks on South Korean financial institutions. “The Chinese-language autonomous penetration-testing tool is designed to automate tasks that typically require human expertise, including scanning systems for vulnerabilities and developing potential attack paths. The tool can connect to AI models developed by Chinese company DeepSeek as well as OpenAI and Anthropic, allowing multiple AI agents to analyze hacking targets and potential intrusion routes.” The paper puts the affected institutions at Shinhan Bank, about 25,000 customers with names, phone numbers, annual income and loan limits exposed; KB Kookmin Bank, 119; Hana Bank, 89; and Yegaram Savings Bank and BNK Busan Bank without figures, with hacking attempts detected at Woori Bank and NH NongHyup Bank and no confirmed leak at either. Lim Jong-in of Korea University is quoted on the pace: “It would be difficult for humans to carry out attacks this fast and on such a large scale across the financial sector in just a matter of days.” Hwang Suk-jin of Dongguk University says the attackers “came in through a window, using an indirect route” into supporting rather than core systems, and warns the breaches may precede “larger follow-up attacks.” The article names no investigating body for the ARTEX finding and says the attacker remains unidentified. It supersedes the Oct 5 card on this board, which had the tool unnamed and its use unconfirmed.
Opening a file's diff was enough to run attacker code in an AI coding agent, through the one git config key its own hardening had missed
GitLab's Threat Research Group published on October 2 a command execution flaw it calls ConfigPoisoning, tracked as CVE-2026-102437 under advisory GHSA-grg2-7gc6-36m6, which “could allow attacker-supplied code to execute when a developer views a file's diff” — the trigger being that “A developer opens the file's diff in DeepSeek-Reasonix's desktop app, an ordinary action for any file with an uncommitted change.” The post states the mechanism against the vendor's own notes: “DeepSeek-Reasonix's own git wrapper hardens several git config keys against command injection, but its own code comment names one gap it hadn't closed: filter.<driver>.clean, which git selects per file through .gitattributes rather than through a fixed config key.” The remedy given is to “Update to DeepSeek-Reasonix Studio 2.21.0 or DeepSeek Reasonix npm 1.39.3,” and the disclosure timeline records the advisory opened with esengine on August 27, accepted on September 29, the fix shipped and the advisory published on September 30, and the CVE assigned the same day. The post carries no CVSS score, no affected version ranges and no statement about exploitation, and says the group “found that multiple widely used coding agents are susceptible” to the same pattern, which it had previously found in Serena.
Anthropic reports the open-weight GLM-5.3 building end-to-end exploits at nearly its own frontier model's rate, and says stripping its refusals cost about $4,400 (via The Next Web)
Anthropic published an evaluation of GLM-5.3's cyber capabilities, which Gigazine dates to September 29 — the only one of the three pages opened here that gives a date for the report itself. The Next Web reports that on ExploitBench “GLM-5.3 built end-to-end exploits in 50 of 410 attempts. Mythos Preview did so in 56,” and that on an internal binary-exploitation set “GLM-5.3 achieved a full control-flow hijack in 4% of 100 tasks, against 6% for Mythos Preview,” while “earlier models, Claude Opus 4.6 and GLM-5.2, managed none”; Gigazine's account of the same comparison also lists Kimi K3 and DeepSeek-V4.1-Flash at a 0% success rate. On safeguards, The Next Web reports that “telling the model it was an autonomous red-team agent got it to engage 64% of the time,” “prefilling its reasoning so it appeared to have agreed raised that to 92%,” and that “a copy with its refusals edited out engaged every time” — an abliterated copy it puts at “roughly $4,400” and “about 2,200 GPU hours” to produce. Business Standard's account of the report has the refusal rate on JailbreakBench and HarmBench falling “from above 90 per cent to around 3 per cent and 2 per cent” after abliteration, puts one exploit-development task at “$20.40 at Zhipu's API prices” using GLM-5.3-Flash, and records the scope limit: “the tests were conducted in isolated, sandboxed environments rather than live systems.” Both Business Standard and Gigazine report that NIST's CAISI has called GLM-5.3 the most cyber-capable open-weight model released to date; no CAISI primary was opened for that. Anthropic's own post could not be opened, so every figure here is carried as the outlet named for it quotes it, and Z.ai has not responded on any page opened here.
An Android banking trojan calls Gemini from the infected phone, while its operator console uses a model to rank which victims are worth attacking
Cleafy Labs analysts Simone Mattia and Alberto Giust trace the command-and-control panel behind RatHat, an Android banking trojan delivered by malvertising and smishing against victims in Europe, Latin America and South-East Asia, across a rebrand from BlackCat to Panda Workshop. The model is used on both sides. On the device: “the implant uses an LLM to keep its own automation working” and “the calls go directly to Gemini flash models from the device, using an API key stored in the malware's own configuration,” for adapting to unfamiliar interfaces. On the operator's screen: “the console uses a model to estimate a victim's balance from the SMS it has already collected,” “devices are aggregated into analysed, high-value and mid-value buckets, so an operator identifies the targets worth attacking,” and the panel can alert “for devices whose AI score exceeds a threshold.” The provider is no longer a choice: earlier BlackCat builds offered “a service selector offering different providers (Alibaba, Anthropic, DeepSeek, Google, OpenAI and Z.ai),” but “by V6, that selector is gone, and the configuration is Gemini-specific, offering 1.5-flash and pro, 2.0-flash and flash-lite,” while “the interface points the operator at Google AI Studio to obtain a key.” Cleafy counts “nearly 100 unique deployments since April 2026.” It is explicit about what it did not see: on the LLM-driven transfer path, “nothing in the analyzed samples performs a fraudulent transfer this way,” and on the device tooling, “neither tool works on Android 14 and above, so the newest devices are left with the MediaProjection and Accessibility combination.” No CVE is assigned.
Given root inside a sandbox, four frontier models found their way back out to the network
Perplexity's Secure Intelligence Institute reports a month-long red team of SPACE, the Firecracker-based microVM sandbox behind Perplexity Computer, in which nine model configurations — among them Claude Opus 5.0, GPT-5.6 Sol, GPT-5.6 Cyber, Gemini 3.1 Pro, Kimi K3, GLM 5.2, Grok 4.20, DeepSeek V4 Pro and Qwen 3.8 27B — were given root inside the guest VM and, in some runs, the sandbox source code. No run escaped the VM-to-host boundary in 108 attempts, and no run beat a no-network configuration in 54 attempts; with partial network access allowing package repositories, four models got out, using forged DNS responses and the shared IP addresses of public package CDNs. The institute says "eight of the ten third-party sandbox platforms" it also tested "exhibited at least one network-policy bypass," and cautions that "cases in which the boundaries held should not be interpreted as evidence that they are perfectly secure."
One operator ran three open-source AI harnesses against online retailers at about $25 a company
Gambit Security's Eyal Sela reports a campaign running since July in which a single operator chained three agent harnesses bought through OpenRouter — Strix for vulnerability search (GLM 5.2, later DeepSeek v4 Pro), Cairn for exploitation (DeepSeek v4.1 Flash) and the open-source Hermes agent for orchestration (Anthropic's opus-4.6). “Between 10 and 15 September alone, 105 attack projects were launched and at least 27 companies were compromised to varying degrees,” including at least 600,000 unexpired credit card details from two of them; “skimmers were ordered against at least 27 named victims and confirmed in place on 19 of them.” The operator's own cost review gives “a mean of $25.46 over 101 completed scans,” against about $7,006 of model spend in four weeks. Gambit names no operator and says errors are possible at this stage of the analysis.
Cisco Talos documents a Windows implant that lets four AI models vote on its next move
Talos describes CLOSEDQUORUM, a 16.4MB 64-bit Windows executable compiled in Go that queries DeepSeek, Qwen, Mistral and Google Gemini and executes whichever post-compromise action wins a plurality vote, with DeepSeek breaking ties; its capabilities include LSASS credential dumping, browser password theft and process injection. Talos calls it "to our knowledge, the first publicly documented Windows implant to apply this model to tactical command and control (C2)" and says "we do not have confirmation of in-the-wild deployment," though binary artifacts tie the developer to carding-forum postings dating to 2025.
Microsoft says attackers are now using the AI brands themselves as the lure
In “Detect and disrupt AI-themed attacks with Microsoft Defender,” Microsoft describes phishing, malware and credential-theft campaigns impersonating ChatGPT, Microsoft Copilot, DeepSeek and Claude. It says a ChatGPT-themed phishing kit built to harvest credit card data drove a campaign that “sent up to 100,000 emails in a single day,” that fraudulent DeepSeek installers were distributed through GitHub, that malvertising for a fake AI Windows plugin delivered the Vidar stealer, and that Claude-themed pages were used for adversary-in-the-middle credential harvesting. It says an initial access broker it tracks as Storm-3075 “used AI-themed malvertising to distribute payloads for multiple downstream actors.”
Anthropic names seven China-based AI companies it says ran industrial-scale distillation against Claude
The Hacker News, reading Anthropic's September 2026 misuse report, says the company attributes illicit distillation campaigns to seven China-based labs and gives each a tracking identifier: Alibaba (GTG-16005), Moonshot AI (GTG-16002), DeepSeek (GTG-16001), Zhipu/Z.ai (GTG-16006), Xiaomi (GTG-16008), SenseTime (GTG-16012) and MiniMax (GTG-16003). It reports 151 million exchanges attributed to Alibaba from more than 3,500 fraudulent accounts between May and July 2026, 23 million to Moonshot from 5,380 accounts over the same window with almost 300,000 customer requests relayed in ten days, and more than 12.1 million to DeepSeek over 14 days in July. Five of the seven — Alibaba, Moonshot, DeepSeek, Z.ai and MiniMax — also appear in the September 8 NSA/CISA/FBI advisory; Xiaomi and SenseTime do not, and StepFun, which the advisory names, is not among Anthropic's seven.
Hundreds of AI agents drive a PaperCut campaign reaching 440 instances in 48 countries
GreyNoise reported a campaign against PaperCut MF/NG in which an actor deployed hundreds of AI agents powered by OpenAI's Codex harness and a DeepSeek model, compromising at least 440 instances hosted by 395 identified victim organizations in 48 countries through CVE-2026-81578 and CVE-2026-82078. It records eleven organizations compromised in 26 seconds and a fastest run from initial access to full domain administrator of seven minutes, attributing the activity to a likely Russian-speaking actor.
A flaw in DeepSeek's agent harness let a sandboxed agent turn its own confinement off with one command
OX Research disclosed CVE-2026-82533 in DeepSeek Harness, in which the local agent-control API “read the 'Host' request header and allowed access if the value was a loopback authority” but “never compared that value with the connection's actual peer address,” so that “a sandboxed AI agent could use a single shell command to call that API and elevate its own session to 'danger-full-access' with approval prompts disabled.” The OpenCVE record, published September 8 with VulnCheck as the assigning authority, covers all versions before 0.1.2-alpha.1 and carries CVSS 9.4 under v4.0 and 9.6 under v3.1. OX says the fix shipped in 0.1.2-alpha.1 on August 27 and that it re-tested the patched build on August 30; it demonstrated the flaw on a default installation and claims no exploitation in the wild.
NSA, CISA and FBI name six China-based AI companies running industrial-scale distillation campaigns against US frontier models
The joint advisory says DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun and Z.AI “extracted billions of tokens across millions of exchanges/requests from U.S. frontier AI models” — naming the Claude, GPT, Gemini and Grok families — “since at least late 2024,” routed through a gray market of API proxies the advisory calls “transfer stations,” which resell frontier-model access below official prices, and through pools of accounts running concurrent sessions with load distribution. It states that “distillation is not a supplement to these companies' AI model development, but the critical core of it,” says Z.AI distilled “billions of tokens of GPT-5.5 data and Claude Opus 4.8 data,” and calls DeepSeek's publicly quoted $5.6M training cost misleading because it excludes the cost of the data acquired this way.
Independent benchmark reports open-weight models matching closed frontier models at vulnerability discovery for about half the cost
Security vendor Aikido ran ten models three times each against 32 freshly disclosed CVEs in a bounded harness with no internet access and frozen prompts, and reported that open-weight models matched or beat closed frontier models on pooled pass@3 recall: DeepSeek V4 Pro found 28 of 32, ahead of Claude Opus 5 and Grok 4.6 at 26 of 32, while three DeepSeek Pro runs cost about $295 against roughly $450–$590 for a single frontier pass. Aikido measured other developers' models with its own harness and none of the scores has been independently reproduced.
Researchers show self-propagating "mind virus" payloads can spread between LLM agents, and that one warning line largely stops them
In a paper titled "Mind Viruses: Self-Propagating Ideas in Multi-Agent LLM Systems" (Papadopoulos, Shah, Zimmerman and Lindsey), researchers demonstrated that goal-carrying payloads can spread from one AI agent to another through ordinary communication and through persistent prompt and memory files, such as SOUL.md and MEMORY.md, that survive session resets. Frontier models proved more resistant than open-weight models such as DeepSeek V3 and Qwen 2.5, a single warning line in the system prompt cut susceptibility to near zero, and the authors reported no successful agent-to-agent spread in deployed systems.
Unit 42 reports Chinese-speaking actor running autonomous attacks with DeepSeek and the Hermes Agent framework
Palo Alto Networks Unit 42 documented a Chinese-speaking threat actor using aliases knaithe and KnYuan who wired DeepSeek into the Hermes Agent framework and orchestrated it over Telegram to autonomously enumerate vulnerabilities, source exploits and launch attacks, including FOFA-driven scanning for exposed Langflow and n8n instances. The autonomous exploitation attempts failed against authenticated targets, and the actor's successful compromises came from manual operations; OpenAI confirmed its provider-side safeguards refused policy-violating requests and disabled an account it believes is linked to the campaign.
UK AISI puts leading open-weight models four to seven months behind the closed cyber frontier
AISI reports that GLM-5.2 and DeepSeek V4-Pro perform similarly to closed frontier models released four to seven months before them, narrowing from the six to ten months it measured through most of 2025. It puts a 100-million-token cyber range run at about $85 for Opus 4.5 and 4.6, about $46 for GLM-5.2 and $1.19 for DeepSeek V4-Pro.
Hunt.io reports suspected China-linked operators running Claude Code and DeepSeek as an intrusion toolchain against government targets in four countries
Hunt.io analysed an exposed open directory containing 2,431 files, including operator logs of LLM sessions, and described a split-model workflow in which Claude Code acted as the execution engine for agentic tool use, bash execution and session persistence while DeepSeek-v4-pro handled attack logic, script generation and decision-making. Hunt.io reported exploitation against an Afghan government application, a Thai government administrative system via SQL injection, and two Taiwanese critical-infrastructure organisations, with reconnaissance against US government entities and financial firms in Europe, Australia and Asia.
Planting guardrail-tripping text in decoy resources cut offensive AI agents' success by about 90% in one vendor's range
Tracebit, which deploys canaries as a product and offers context bombs as an option, published a July working paper testing them — "a short piece of text designed to trigger safety guardrails in offensive AI agents", planted in a decoy such as a Secrets Manager secret — across 152 scored attack runs in a range of roughly 300 AWS resources with ten distinct attack paths. It gives all-model average full-account-admin success falling from 57% to 5%, full compromise from 36% to 1% and completion of any attack path from 91% to 15% across Opus 4.8, Gemini 3.1 Pro, GLM 5.2, DeepSeek 4 Pro and Kimi K2.6, with Opus 4.8's admin rate going from 93% to 0%; Tracebit says it is "still working to try to assess OpenAI models reliably in the range".