Description: CrowdStrike reported that VAPOR PANDA, a China-linked espionage group, used ARTEX, an AI penetration-testing framework, with a DeepSeek language model and an unidentified commercial model to attack government and corporate systems worldwide. Investigators confirmed unauthorized access and follow-on activity at nine organizations, including backdoor deployment. More than 200 organizations were reportedly targeted.
Entities
View all entitiesAlleged: Large language model developers , DeepSeek , ARTEX developers and AI agent system developers developed an AI system deployed by VAPOR PANDA , Threat actors , hackers , China-linked threat actors , AI agent system deployers and Agentic threat actors, which harmed Telecommunications providers , Privacy , Pharmaceutical companies , Organizations , Information integrity , Governments , Government agencies and Companies.
Alleged implicated AI systems: DeepSeek , Large language models , ARTEX , AI penetration testing systems and AI agent systems
Incident Stats
Incident ID
1794
Report Count
1
Incident Date
2026-10-17
Editors
Daniel Atherton
Incident Reports
Reports Timeline
Loading...
CrowdStrike OverWatch identified a VAPOR PANDA campaign using ARTEX alongside the Chinese-developed DeepSeek large language model (LLM) and a second commercial LLM to conduct intrusions against multiple high-value targets in parallel.
Begin…
Variants
A "variant" is an AI incident similar to a known case—it has the same causes, harms, and AI system. Instead of listing it separately, we group it under the first reported incident. Unlike other incidents, variants do not need to have been reported outside the AIID. Learn more from the research paper.
Seen something similar?