{"slug": "a-chinese-llm-attacked-our-lab-so-we-made-it-work-for-us", "title": "A Chinese LLM attacked our lab, so we made it work for us", "summary": "Jesta Security reported that a Chinese AI agent, identified as deepseek-v4-flash-free, conducted a five-day LLM-managed cyber attack campaign against its lab, marking the first time the exact model behind a live attack was identified. The agent, which targeted over 1,000 victims for proxyjacking and attack generation, was taken control of by Jesta researchers, who steered it to reveal its origin and operations. The attack involved over 300,000 break-in attempts, with the AI agent operating at super-human speed and evading detection through US-based infrastructure.", "body_md": "For five days an autonomous AI agent worked to break into our lab. We became the first to identify the exact model behind a live attack, **deepseek-v4-flash-free**, from inside the attack itself. Then we did something no one else did. **We took control of it.**\n\n**5 days.** That's how long the first live, **LLM-managed cyber attack campaign** we've detected hit our lab at [Jesta Security](https://jesta.ai). And for **what?** To set up **proxyjacking** and **generate more attacks**.\n\nFrom what we uncovered, over **1,000 victims** had already been hit the same way, most likely also being used to generate fresh attacks every second. And if this is only what we stumbled onto, we believe the real number is far **higher**.\n\nDuring our research on defense against AI attackers, we took our lab and stood it up in the field, behind **US-based infrastructure**. We opened a port and waited for attackers to come to us. Within a week, we had logged over **300,000 attempts** to break in: botnets, credential stuffing, the usual internet noise. And then something surfaced that did not fit the pattern. After a thorough investigation, we traced it back through a **US-based cover** to its real source, a **Chinese attacker**. And here is the exciting part: the attacker was not a person at all. It was an **AI, deepseek-v4-flash-free**. And we didn't just watch it. **We took the wheel,** steering the agent into giving up its own operation: the model behind it, its origin, its goal, and the targets it had already victimized.\n\nLet's dive in.\n\n## Background\n\nBy now you have probably heard the headlines. As the US government keeps banning newer models from being released to the public (*Mythos* almighty), the inevitable conclusion is that those models are so capable of cyber warfare that the government itself treats those models as weapons of mass destruction to be classified away from the public. Only in the last week, we saw *ChatGPT 5.6 sol* escaping its own sandbox and breaking into Hugging Face, finding and implementing **2** *zero-day* vulnerabilities - and that's only to cheat on a benchmark. But, you would say, and rightly so - that was only a closed benchmark, a test, with no actual proof of real operational capability, right? Well, actually, earlier this month researchers published *“JadePuffer”* - the first ransomware attack carried out by an AI agent on its own. Set in motion by a human operator, but executed end-to-end by the agent, from reconnaissance to extortion. To this day, *no one* knows which model was behind it. That shows how novelty attacks are becoming the future of AI attackers.\n\nThis blog is about the *attack that hit us*. How an AI agent worked our lab for five days. How, for the *first time*, we *identified* the *exact model* attacking us. And more importantly, how *we took control of it*.\n\n## First Sighting\n\nIt was a quiet Thursday, we were wrapping up the lab results that we set up in the wild when we unexpectedly noticed some activity that caught our eye. After verifying that no one on our side was touching the setup, we kept a close watch and let it continue.\n\nSpecifically, we noticed an unusual entity - not holding a session, but running a single command on each connection. That entity started scanning the environment, behaving like a **human** - iterating on each command, but at **super-human speed**.\n\n## Caught in the act\n\nBefore we show what it did, here is how we caught it. We had **seeded the environment with a few things a language model cannot ignore**, nothing a human would look at twice, and then we waited.\n\nAfter the first interactions, we noticed the model (to be identified in the future) tried for hours to execute commands to piece together the information it wanted, but constantly failed:\n\nIt kept using non-existent flags, binaries, and one-liners that failed, and we suspect that's why it finally has resorted to writing its own scripts. This entire time, the model kept interacting with our methods.\n\nEventually, **our capabilities** affected the **model's reasoning**, forcing it to execute a command it shouldn't have:\n\n**Our lab setup worked**!\n\nWe successfully made the model use a tool that only an unsupervised AI would have used. Then we thought - could we go further?\n\nWe kept leading the attacker down a path of our choosing, and then the attacker introduced more and more clues, until finally **we caught it**:\n\nThere it was, in its own commands: **deepseek-v4-flash-free**. DeepSeek's V4 Flash, on the free tier, the plan anyone on earth can sign up for in two minutes. It handed that over without ever realizing it is working against its own goals and interests.\n\nAt some point the agent stopped improvising commands by hand and dropped its own tooling onto the setup: a script to profile the machine and report back. At the very top of that script, repeated in session after session for hours, **we coerced it to name itself again**:\n\nThis is the **first time the specific model behind a live intrusion has been named from inside the intrusion itself**. Not guesses based on IP or inferred from behavior. This is live off the attacker, mid-attack.\n\nThe rest of the script is the other half of the tell, the part that shows the basic information the model was after:\n\nWe suspected that this was a part of a larger campaign and was likely tied to the entire infrastructure actively compromising victims. We decided not to stop there, and we pushed our capabilities against it, pushing to take control of the agent itself. To control it means to steer it, because we did get the answer *“Who?”*, but we didn't get an answer to *“Why?”* and *“What does it want?”*. After hours of persistent work, we finally managed to steer the agent into **extracting its own target list** straight out of the model - the other machines it was working through, each already paired with working credentials:\n\nOurs was one line in a spreadsheet. The goal was **proxyjacking**: install a small SOCKS5 proxy, open it to the internet, and quietly turn a weakly secured rented server into an exit node for someone else's traffic and attacks. **1283 hosts is only what we could see,** which means the real number is almost certainly **higher**. To continue our investigation, we let the model keep working and followed along.\n\n## How it planted the proxy\n\nThe way it deployed that proxy was the clearest look we got at the machine behind the keyboard. It did not do it in one clean step. It ran a fallback chain, and it never once stopped to think between links.\n\nFirst it reached for the easy path, pulling the binary straight from its own staging server:\n\nThat server was not reachable from our lab. The model itself hallucinated and used an internal address that would never work outside of the network. At machine speed - it already had the next method loaded. It switched delivery on its own, piping the binary in as base64 and decoding it in place:\n\nThat “echo OK” command - a pure **completion marker AI agents** utilize as part of their command-execution protocol. Then, it launched the proxy in the background, checked that the process and port were live, and reached out to a public domain to confirm the box could actually route traffic to the outside world:\n\nThe proxy was not the goal at all. The platform was the prize here. A SOCKS5 node placed on a device can turn that device into a **base station**, a clean, unattributed point that the operator uses to route the **next round of attacks** through it. All of the attacks, scans, and intrusions that follow come from our address, not from the actual source location. The plan was to construct a network of **cover bases** - a common attacker technique to disguise, break attribution, and launch operations using the compromised infrastructure & network.\n\n## Five days, autonomously\n\nOver five days, the agent opened a session, ran exactly one command, and disconnected. Then it did it again. **871 times.** Most sessions lasted under 2 seconds, with pauses between them that felt less like a coffee break and more like something thinking.\n\nThe first contact, on July 2, was a 90-second recon touch: log in, confirm the box is real and reachable, leave. Then silence for three and a half days. It had scouted us, filed us into a queue, and scheduled a return.\n\nIt came back on July 6 and worked for 9 hours. That is where it truly gave itself away. It wanted the CPU model out of the machine and could not get it, so it tried again, and again, **21 times**, each attempting a slight rewording of the last, grinding on the same wall for 25 minutes. When it finally gave up, it did not error out. It made up an answer and hardcoded fake values into its own output as if inventing the data were the same as collecting it:\n\nThis was a hallucination. When investigating further, the timing was interesting - those nine hours ran from just after nine in the morning to just past six in the evening in the **East Asia time zone**, on a Monday. The recon days earlier landed on a Thursday night. The infrastructure was a rented cloud address that leads nowhere. Leaked environment variables led to *“CST-8”*. **The rhythm of the work and the model pointed east.**\n\n## Expanding the attack\n\nThe model continued to the next stage: **Launching future attacks** and expanding the network of breached victims:\n\nThe model even wrote a script to continue:\n\nRight there, we understood the goal of the model - **autonomously create a network of base stations**.\n\n## So what now?\n\nPeople and organizations are now starting to understand what we've already seen: the next attackers they're going to face **are humanlike, but not human**. They think and adjust as a human would, yet do so at extreme speed, much more efficiently, and can autonomously handle complex cyber tasks. The rise of cyber-oriented LLMs, **especially the Chinese open-weight ones**, makes **cyber attacks a commodity** - so deploying end-to-end campaigns is trivial, not to mention the scale and mass of these attacks. We are entering a new era of cybersecurity, where the **old security perceptions** no longer hold. We are facing a **novelty of attacks**, adversaries that think like a machine and move through **sophisticated paths most organizations aren't even familiar with yet**. Defending against them requires a new class of tools, built from the ground up for AI threats, not the legacy defenses we've relied on until now.\n\nThat said, **timing is the key**. Organizations have a critical opportunity to prepare themselves for the future. They first need to **seriously understand the risks** waiting just around the corner. Only then will they be able to address them in the unique way that this new era demands. If you want to hear more about what we've seen and how to defend against it, reach out to us at [Jesta Security](https://jesta.ai).\n\n## Indicators\n\n### The model\n\n**deepseek-v4-flash-free**(DeepSeek V4 Flash, free tier)- Driver: an autonomous LLM agent\n\n### Behavioral signature\n\n- One command per session, reconnecting statelessly, with think-time pauses between actions\n- Machine-structured output (HN:/KN:/CO:/MT: field tags) written for a parser\n- Retry loops that reword the same failed command\n- Invented values hardcoded in when a read fails, rather than an error\n- A delivery chain that fails over on its own: pull from a staging server, then base64 over stdin, then rename and retry\n- A pre-staged pipeline: tooling expected to already be on disk, a target list carried in, cracked credentials ready to reuse\n\n### The payloads and delivery\n\n- MicroSocks SOCKS5 proxy, verified against a live domain before use\n- MicroSocks SHA-256: ab9ed2896ebe21289820423d55cf1b6f37fb5558c0bb37e35180567f5fa92c6d\n- MicroSocks BuildID: a5bf6b1372343fa489d0f2d151380fa0569dae63\n- Delivery fallback: base64 over stdin, decoded in place to /tmp/microsocks and /tmp/ms\n\n### Attacker infrastructure\n\n| Address | Role |\n|---|---|\n| 52.4.X.X | Attacker source. 9 instances operated from this address - the ones the relay accepted connections from |\n| 172.31.X.X | Staging server. 3 addresses in this range, all hallucinated by the model and never reachable |\n\nAttacker-side addresses only - the victim hosts are deliberately not listed. The last two octets are masked throughout, and where several hosts share a range the count is given in the description rather than repeated as identical rows. The victim list contains **1,283 victims**, and for privacy reasons will not be published.\n\nThe three staging addresses were never real. **172.31.x.x is RFC1918 private space** - an address that only means anything inside the network it belongs to. The model invented it, tried to pull its payload from it across the open internet, and carried on as though the fetch had worked. The same range shows up again in the hostname it made up when it could not read the machine: `ip-172-31-X-X`\n\n.", "url": "https://wpnews.pro/news/a-chinese-llm-attacked-our-lab-so-we-made-it-work-for-us", "canonical_source": "https://jesta.ai/blog/darkreasoning", "published_at": "2026-08-03 17:02:42+00:00", "updated_at": "2026-08-03 17:22:52.093787+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-safety", "ai-policy"], "entities": ["Jesta Security", "deepseek-v4-flash-free", "ChatGPT 5.6 sol", "Hugging Face", "JadePuffer"], "alternates": {"html": "https://wpnews.pro/news/a-chinese-llm-attacked-our-lab-so-we-made-it-work-for-us", "markdown": "https://wpnews.pro/news/a-chinese-llm-attacked-our-lab-so-we-made-it-work-for-us.md", "text": "https://wpnews.pro/news/a-chinese-llm-attacked-our-lab-so-we-made-it-work-for-us.txt", "jsonld": "https://wpnews.pro/news/a-chinese-llm-attacked-our-lab-so-we-made-it-work-for-us.jsonld"}}