CrowdStrike: China used AI on 200 groups

China-linked hackers used AI agents to target more than 200 organisations in 11 days, CrowdStrike said on the 29th of October 2026. AI agents are programs that carry out tasks on their own.

CrowdStrike calls the group VAPOR PANDA. It confirmed that the hackers got inside 9 of the organisations.

How the attack worked

The group used a free tool called ARTEX that runs many agents at once, CrowdStrike said. The agents ran mainly on DeepSeek, a Chinese AI model.

A human gave orders in Chinese at key points, CrowdStrike said. In one break-in, the agents read about 1.4 billion tokens, the word pieces AI reads.

Who was targeted

Targets were in at least 14 countries and included government ministries, CrowdStrike said. Chip, defence and research groups were also on the list.

The hackers told agents to look for computers without CrowdStrike's own security software, the firm said.

Below we break down the scale

More than 200 targets over 11 days is about 18 targets a day, by our arithmetic. Confirmed break-ins, 9 of 200, are under 5%.

CrowdStrike also saw password attacks on at least 12 more groups.

What is confirmed and what is not

The figures come from CrowdStrike and were not checked by others. Another outlet reported a higher number of victims, which CrowdStrike's own post does not support.

Key facts

CrowdStrike says VAPOR PANDA targeted more than 200 organisations in 11 days.

The group's AI agents ran mainly on DeepSeek.

CrowdStrike confirmed break-ins at 9 organisations.

The campaign began on the 17th of October 2026.