Suspected Chinese hackers chain DeepSeek and Claude Code AI tools to breach government systems in three countries
Government networks in three countries were breached by suspected Chinese state hackers who split the work between two AI systems: DeepSeek for attack planning, Claude Code for execution, per Cybersecurity News. No single AI vendor saw the full attack chain.
Suspected Chinese state hackers breached government systems in three countries by chaining two commercial AI systems together, according to reporting by Cybersecurity News and CyberPress. Researchers describe a division of labor: a DeepSeek model handled attack reasoning, exploit adaptation and script generation, while Claude Code executed commands, kept sessions alive and built phishing pages. The campaign was uncovered in June 2026. The setup matters beyond these intrusions. AI providers monitor their own platforms for abuse, and that model works when an attack runs through a single system. Splitting the kill chain across competing vendors means each company sees only a fragment of the operation, and none sees enough to recognize an attack in progress. Defenders face a similar asymmetry: detection and attribution tooling is built around human operators with consistent habits, not interchangeable model backends. It also shifts what is scarce. If reasoning, exploitation and execution can be delegated to off-the-shelf models, the limiting factor is no longer skilled operators but access and intent. Government networks with legacy authentication and slow patch cycles are the natural first targets, and the three countries affected here are unlikely to be the last.