Espionage from China: AI agents target over 200 organisations

For months, discussion about the impact of artificial intelligence on cybersecurity has focused on future scenarios or small operational aids: emails written in impeccable Italian to deceive employees, digital assistants asked to find errors in code, or manipulated prompts to bypass ethical filters. But the events that have emerged in recent hours show that this chapter has already been overtaken. A large-scale operation originating in Beijing marks the field debut of so-called autonomous agentic systems, capable of conducting complex attacks without a human operator having to type individual commands.

The offensive, attributed to the Chinese cyberespionage group known to analysts as Vapor Panda, targeted more than two hundred organisations worldwide in less than two weeks. Targets included foreign ministries in Europe, Latin America and Asia, senior institutional offices, telecommunications giants and nineteen strategic US companies operating in critical sectors such as defence, nuclear energy, semiconductors and pharmaceuticals. What made such rapid expansion possible was not an army of programmers, but a program called ARTEX, a platform developed in China that turns language models into operational specialists capable of cooperating with one another.

How a team of artificial digital intruders works

To understand the generational leap represented by this attack, we need to abandon the image of a lone hacker sitting in front of a black screen manually trying to crack a password. With agentic systems, the architecture instead resembles a complex, entirely virtual corporate chain of command.

At the top are the "planning" agents. These algorithms receive a high-level task — for example, entering a ministry’s network and extracting confidential documents — and autonomously break it down into dozens of logical steps: studying the target’s layout, looking for open ports, identifying active defences and planning subsequent moves. Below them works a host of "operational" agents, synthetic programmers and analysts tasked with executing individual orders, such as writing a small piece of custom software to exploit a particular vulnerability or querying a remote repository.

This entire process runs on computation and natural language. In just one monitored intrusion, the decision-making engines processed around 1.4 billion "tokens" — the equivalent of hundreds of thousands of pages of text — to analyse the target computers’ responses in real time, assess what was happening and adjust their approach. The system did not use a single artificial brain, but combined Eastern models such as DeepSeek with subscription-based Western commercial platforms, exploiting each one’s strengths to solve specific problems.

The ability to work around obstacles without stopping

The real difference between a normal automated program and an intelligent agent lies in its response to the unexpected. Traditional software, when faced with a closed door or an error message, stops and waits for new instructions. AI-driven agents, by contrast, reason about the failure and look for another route.

Intrusion logs show behaviour that until recently required hours of thought from an experienced professional. Faced with well-protected security systems, agents scanned infrastructure for blind spots, identifying servers and peripheral computers where modern corporate "digital alarms" had not been installed, and then moved undisturbed through those unprotected areas.

In other cases, the system demonstrated a marked ability to connect disparate clues: it recovered old authentication certificates neglected for years to get past initial checks, entered corporate email accounts to read employees’ sent messages, found virtual private network configurations there and used them to open the organisation’s internal doors. If an intrusion attempt failed on a cloud service, the agent instantly changed targets, testing the container registry or system administrators’ permissions.

The new human role and the defence dilemma

This change of pace has reversed the relationship between humans and machines. In conventional operations, humans do the heavy lifting and the algorithm provides support; here the human has become a strategic supervisor watching from a distance. The human operator needs only to set the course, intervene in rare moments of deadlock to authorise a particularly sensitive step and keep the AI’s moves from attracting too much attention.

The consequences for global security and the artificial intelligence market are profound. First, the fragility of the moral filters imposed by major technology companies on their models becomes apparent: when a destructive objective is broken into hundreds of tiny, seemingly harmless tasks — analysing a text string, checking a file format, rephrasing a request — the model does not recognise the malicious intent and readily cooperates.

Second, the scalability of the attack creates an unmanageable imbalance for defenders. A tiny team of operators in Beijing was able to manage hundreds of complex infiltration paths around the planet simultaneously. For experts in corporate and government security centres, staffed by human analysts subject to fatigue and human reaction times, responding blow for blow becomes impossible. The only way to contain intrusions orchestrated by swarms of artificial intelligences will be to entrust surveillance and response to equivalent autonomous agents, ushering in an era in which cybersecurity will be a game played in milliseconds, entirely between machines.