Chinese-linked hackers use AI agents on compromised networks, Google says

Google’s Threat Intelligence Group says Chinese hacker groups are moving beyond basic AI prompts toward AI agents that can operate on compromised networks and automate parts of cyberattacks with limited human involvement. [1][2][3]

The reported capabilities include autonomous reconnaissance and attempts to exploit multiple software vulnerabilities. The account attributes these observations to Google and Palo Alto Networks’ Unit 42 rather than identifying one named campaign. [1][2][3]

Some campaigns described in the reporting took less than six hours from start to finish. That is presented as an operational-speed finding, not evidence that every attack using AI follows the same timeline. [1][2][3]

The reporting says U.S. critical-infrastructure operators have seen signs of AI-assisted hacking, including faster exploitation of newly discovered flaws and automated phishing tools. It does not name affected operators or confirm an outage. [1][2][3]

The account describes participation by both state-backed intelligence agencies and cybercrime gangs, while preserving uncertainty about the precise actors behind individual operations. It also says researchers expect further experimentation with autonomous agents over the next six to nine months. [1][2][3]