Claude Qwen and DeepSeek Agents Used In Spying

Published on September 3, 2026 Hunt.io The report documented a spy campaign conducted across Asia. A Chinese speaking operator used Claude, Qwen and DeepSeek agents in attacks on state and educational systems. The operation caused by five directories left on the open was spread to six countries. In this article, the architecture of the campaign, approved violations, explains the old used and addresses the lessons required to remove institutions.

What is the SecFlow Campaign and How Does it Out?

The operation was revealed by an error in the own infrastructure of the attacker. Hunt.ioIn the report published by ' According to the fact that the researchers found a load for Kuomintang Party Date Archives in Taiwan in an open index copied on July 24. The query made from the proxy server address inside the load has matched 120 file content on five separate servers and connecting five working areas of a single campaign together.

Five directories were undertaken different tasks: an artificial intelligence orkestration server, a Java abuse workspace, a fake MySQL service, credentials test nodes and load distribution store. The campaign was touched to six countries and close to him. Among the goals, the Ministry of Foreign Affairs of Indonesia, state and educational institutions in China, located in the business network of industrial systems in Puerto Rico and a telecom operator in Afghanistan.

Hunt.io The findings first reported the interfering teams of national cyber events of countries related to the TLP:AMBER label and the responsible statement waited until the process was completed. Team in July A separate campaign used by Claude Code and DeepSeek He documented. Different infrastructure, vehicle and targets; repetitive thing positioning commercial artificial intelligence models as operational component.

How to Install Model Changeable Agent Architecture?

In the center of the campaign there is a roof of orkestration called SecFlow. SecFlow translates campaign targets into short tasks and distributes these tasks to specialized agents. Each agent is defined by means, target information, common file space and network routes. Thanks to the common file space, the next agents can access previous findings, so a single target can be branched into multiple specialist tasks.

Five models were defined in the saved working time settings. SecFlow is launching Claude ACP or Qwen Code wrapper, injecting a model name and API route into it, then the wide tool permissions were fit. According to the news published in GBHackers The bypassPermissions setting and roado approval was explained in the profiles, i.e. the mechanism of the agent to request approval before the action was disabled.

The most vivid buyer of the architecture appears here. The task interface was able to switch from Claude, Qwen and DeepSeek profiles without any change. Attack work flow is independent of the model; if the provider changes, an account is closed, or if a route is interrupted, the operation itself remains standing. Agent artificial intelligence The separation of the model with the roof in the systems is considered flexibility on the legitimate development side, giving endurance on the attack side.

The directive file given to agents was also written as a professional leak test guide. The central policy file has passed every goal in the start, exploration, abuse, post and reporting stages, set the technology stack and possible attack paths in the exploration step. Every candidate road was directed to a special game book to the poor class.

What Data Was Held in Fengtai Violation?

The deepest approved violation of the campaign was experienced in a office automation environment belonging to Fengtai District. The attack was launched from an open web app to the internet and transmitted Windows command, internal exploration, identity information theft, persistentness in the application layer, lateral motion trials and data leaking.

The operator divides the memory casting on the server to 37 wires instead of pulling in one piece. Every block asked via an authentication route, confirmed the number of anticipated bytes and merged the file again. The system record book was also collected. A total of 822 user accounts were recorded on the database side.

The most sinful part in terms of defense after that. The operator added and confirmed the authorizations of the application to an upgraded new and active account. This created an independent way of permanentness from vehicles on Windows. Even single cleaning of the script shells does not prevent this account to access management functions.

In leaked content, 949 additional files and about 1,28 GB data were included. In addition to administrative workflow records, there were also a chronic disease report, which includes documents and patient information related to health.

The second approved breach occurred on a Chinese educational AI platform and the table is gaining a different size here. The management interface without authentication rotates 23 agents configuration, 14 full secret space and 104 full dialogue record. Suzan Dify credentials were successfully used against production API and spent 631 tokens. In 92 messages inputs in recordings, there were profile information such as student name, number, consultant and department. The same interface also agreed to write a new agent configuration without authentication, which brings the risk of guiding agents and supply chain abuse per day.

What Known Opens Are Used In Attack?

There is nothing new in the technical repertuvar of the campaign. CVE was used eight-named in active workflows and all known for years, explains the spread out. According to the news published in Cyberpress This explains from 2014 to 2024.

The most familiar name in the list Log4Shell. NVD registration This open, published at the end of 2021, had been counted in the event of the year in the sector and applied the large part of the institutions. Shellshock dated 2014. All of the entrance doors in the operation where artificial intelligence agents speed up the work was expected to be closed for years.

The table carries a direct message for the defending side. The first measure to be taken against an artificial intelligence-supported campaign is not to buy a new generation of tools, close the old open in inventory.

How to Grow Artificial Intelligence Agent Misinformation?

The most tutorial of the report is not a success, but an error. One of the agents reported that a trial for Shiro deficit was successful. Recovered evidence did not support this claim. The problem was that the claim did not stay there.

Thanks to the common file space, the next agents were taken as a true verified by this finding. More than 27 follow-up tests were conducted on the basis of the wrong pioneer, and all remained without results. Although agents continue to take new tasks through the same assumption.

This behavior shows the double-way nature of agent architecture. Connected workers accelerated the operation of transportation between the workers, the same mechanism was an error, and the entire workflow. There is also a similar risk when you are looking at the same case by defending: a non-correction layer is consolidated in every step of the first step.

Agent-supported ransomware attack a similar picture was seen in the case. There was also not able to produce most of the agent commands correctly in the first trial, they have repeatedly corrected. The picture that occurs when two cases are read together is: the agents do not replace the operator, increase speed and multiply the error at the same rate.

How Can Model Providers Block This Usage?

A special model was not used in the campaign. The commercial vehicles and official APIs run by millions of developers were in the circuit. The problem is how this traffic looks to the provider.

Model requests were not only passed from official routes. The operator was installed private relays under its own domain name family and these relays were offering Claude compatible end spots with DeepSeek. An open source artificial intelligence gateway was working in the same field family. Such gateways redistribute multiple subscriptions or API keys from a single end point. There is the use of meşru, but it also halves to hide account sharing and exceed regional restrictions. There was a proxy server pool management panel.

The total effect of layers is: requests appear on the provider side are broken from the actual user and the actual goal. When poor usage detection is based on account behavior, the combined pool and relay layers blur that behavior.

Harmful AI models Home The discussion was conducted over filterless models sold in underground forums for years. The last two campaigns documented carry the discussion to another place: the matter is not the model itself, but by passing through which layers of the legitimate model. Cybersecurity tests of OpenAI Home Walking isolation discussion around the summer was also interested in the laboratory side. This case is experienced on the field, production APIs.

What Do Institutions Do Against This Risk?

The violations approved by the campaign were based on classical weaknesses: open services to the internet, patchless applications, stolen ID information and tools after the attack. Artificial intelligence adds speed and width to this chain, did not invented a new way of entry. They are listed accordingly.

Close old open: All eight CVE in the list is patched. Applications in the inventory are scanned for this explains and the result should not be written to the next care window, this week.

Open index control: The campaign was solved due to its own open directories of the attacker. The same error is also common on the defense side. Is the index listing off on the servers of the institution, backup and log files are open to the internet, should be checked regularly.

Watch the application layer accounts: Permanentness in the case of Fengtai was founded in the application database, not on the operating system side. The creation and authorization changes of authorized accounts should be logged and reviewed regularly.

Reduces the life of identity information: Long-life switches standing in configuration files, front-face packages and container material were collected directly in this campaign. Short-life identification information reduces the value of this collection.

AI management interfaces also count assets: Training platform breach was experienced due to an unidentified agent management panel. The agency platforms working in the institution are subjected to strict access control up to at least database servers.

On the defense side, artificial intelligence itself is positioned at the same speed. GPT-5.4 Cyber Special models and agent-based defense systems are marketed by the claim of responding to the tempo on the attack side. According to the news published in Security Affairs The second time in two months commercial artificial intelligence coding tools were caught in a live state-connected leak operation. The repeat of the cough shows that this is not a single case.

Frequently Asked Questions

What is SecFlow and how it works?

SecFlow is the roof of an artificial intelligence orchestrating that the attacker uses. The campaign divides its targets into short tasks and distributes these tasks into specialized agents such as discovery, exploitation, data collection and reporting. It defines vehicle, target information, common file space and network route to agents. Not a commercial product, the operator has been documented as a structure that he owns.

Claude, Qwen or DeepSeek risk for institutions using?

No, there is no vulnerability detected in these models. The report does not claim that products work defective. Risk is born from what permissions of agent vehicles, which are operated under network routes and which audit. The approval was decisive in this case to disable the kipinin and provide large vehicle permissions.

What security statements used?

CVE was seen eight names in active workflows: Shellshock, Ghostcat, Spring4Shell, Shiro deseriization, Grafana and Nexus directories transitions, Nacos authentication and Log4Shell. All known and published. Not used for zero days.

Is this campaign aimed at institutions in Turkey?

The published report was not reported to the target from Turkey. Approved violations and screening activity were detected in Taiwan, Indonesia, China, Vietnam and Afghanistan. All of the open used is not true to assume a geographic security limit as it is located in common corporate software.

What is the first thing to do?

Make inventory scan for eight CVE passing in the report. The fastest win is here because all of the entrance paths are patched. Then open index audit comes from review of authorized accounts in the application layer and shortening the life of identification information.

The campaign was solved by the attacker’s own open directories. The trace that operations carried out with agents left behind is much more readable than the classic script history: task definitions, directive files and evidence files stand in plain text. Hunt.ioThe five working areas that ‘re saved show the monthly runtime of a operator, does not know how similar working areas are open on several servers.