One operator directing AI agents compromised 200+ organizations in 11 days. What matters is the efficiency: a single human supervising dozens of parallel agent workflows to hit foreign ministries, U.S. defense contractors, semiconductor firms, and telecom providers across 14 countries.
VAPOR PANDA’s ARTEX framework automated reconnaissance, vulnerability discovery, and exploitation starting October 17, 2026. The campaign consumed 1.4 billion tokens using DeepSeek and an unidentified second commercial LLM, with humans approving decisions at critical junctures.
The mechanics are standard: SAML assertion bypass, XXE, constrained delegation. Nine targets confirmed BLOODALCHEMY backdoor deployment. No novel exploits.
The shift is in the operator bottleneck dissolving. Espionage teams have always been limited by how many targets humans can manage. ARTEX let one operator supervise dozens of workflows simultaneously. The use of multiple LLMs means no vendor lock-in. If this pattern spreads, state-sponsored operations reach new scale.
Sources: VAPOR PANDA Uses AI-Driven ARTEX to Grow Global Espionage Campaign
Coverage: Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide • China-Nexus VAPOR PANDA Breached Nine of 200-Plus Targets With AI Agents
Related on this blog: [AUTO] First Autonomous AI Attack on Critical Infrastructure • [AUTO] Blue Moon’s Real Story Isn’t AI • [AUTO] Meta Muse’s Undocumented Microphone Backdoor