Cybersecurity teams are tracking a troubling shift in how Chinese hackers use AI – Automated Home

Chinese hackers are changing how artificial intelligence fits into cyberattacks. One important shift is where the AI can run. Google says suspected China-linked actor UNC6508 has compromised cloud environments to deploy local large-language-model infrastructure.

Running an open-weight model inside compromised infrastructure can let attackers use victim computing resources while avoiding commercial AI API monitoring. Google’s September 2026 threat report places this activity within a broader move from basic AI prompting toward more automated and agentic cyber operations.

Hackers are putting AI inside victims’ clouds

Hackers are increasingly treating compromised cloud environments as places to operate AI rather than merely as stepping stones toward other systems. Google’s Threat Intelligence Group identifies UNC6508 as an important example of China-linked espionage activity involving AI.

UNC6508 has been active since at least 2023 and has targeted North American academic, medical, and military research organizations. Google says the group specifically targets proprietary AI research and has also been linked to suspected compromises of cloud environments used to deploy local LLM infrastructure.

Some UNC6508 intrusions remained undetected for more than a year, giving the operators extended access to sensitive research environments and other information of intelligence value.

Why stolen compute is so valuable

Running models on compromised infrastructure can give attackers access to computing resources without bearing the normal cost of operating that infrastructure. Google says access to premium AI models and high-performance compute remains a significant barrier for threat actors, creating an incentive to hijack victim resources.

Local deployment can also reduce dependence on commercial AI services and their abuse-monitoring systems. Google says UNC6508 used a local open-weight model in compromised infrastructure, while a separate 2026 intrusion involved unauthorized AI infrastructure and expanded high-performance compute resources inside a victim’s cloud environment.

How the AI operation works

Google has documented several ways attackers are combining compromised cloud infrastructure with AI. In suspected UNC6508 activity, the group deployed local LLM infrastructure inside breached cloud environments, allowing it to use an open-weight model without relying on commercial AI APIs.

Other 2026 incidents show different parts of the emerging pattern. One attacker entered a cloud environment through an exposed GitHub token and deployed unauthorized AI infrastructure, while separate threat actors used AI to assist with reconnaissance, exploit development, phishing and troubleshooting. Together, the cases show how AI can become integrated into multiple stages of a cyber operation.

Little-known fact: UNC6508 used custom malware called INFINITERED to steal login credentials from breached REDCap research-data servers before moving deeper into victim networks.

What does agentic AI change

The larger concern is that AI can compress work that once required repeated human intervention. Google describes PRC-linked activity moving toward agentic frameworks that can perform several stages of an operation with less direct oversight.

One PRC-linked group attempted to build an AI-driven penetration-testing agent using models such as Gemini. The system was designed to perform port scanning and parse services. It could also conduct initial discovery, showing how AI can automate reconnaissance tasks.

Multiple models can speed attacks

PRC-linked operators have also used CC Switch to query multiple AI models, including Claude, Gemini and Codex. These models have helped write custom exploit scripts, craft spear-phishing lures, and debug commands used after gaining access.

A separate Q2 2026 example showed how quickly agentic automation can scale. A financially motivated actor compromised a cloud environment. Multiple agents then planned and executed credential theft in under six hours.

The campaign compromised thousands of credentials while requiring limited human oversight, according to the report’s example. That actor was not necessarily China-linked. However, the incident illustrates how quickly automated workflows can turn cloud access into a large campaign.

Little-known fact: Russia’s Sandworm group (also tracked as APT44) has used Gemini to write Python scripts for password spraying and endpoint fingerprinting against Ukrainian targets.

AI itself is becoming a target

The threat is not limited to using AI as an attack tool. Google’s findings show that AI systems, research and developer credentials are also becoming valuable targets.

Attackers have targeted proprietary AI repositories, API credentials, and configuration files used by AI development tools. Google found credential-stealing malware targeting configuration stores that can contain plaintext API keys or model-routing endpoints, potentially giving attackers access to paid AI services and related infrastructure.

What should developers protect first?

Developers should protect AI API keys and model configurations like other critical secrets. A stolen key can give attackers access to paid services, private projects, or cloud resources.

Teams should also review hidden configuration directories and repository contents for credentials. Removing exposed secrets, limiting permissions, and rotating keys can reduce the value of stolen development environments.

What should defenders watch closely?

Security teams should treat unexpected computing activity as a possible security signal, particularly when GPU usage suddenly rises. New cloud servers, unfamiliar workloads, or unexplained increases in infrastructure costs can also indicate unauthorized AI activity.

Monitoring should extend beyond passwords and perimeter traffic. Teams need cloud telemetry, workload visibility, and anomaly detection. These controls can reveal unfamiliar jobs, containers, model-serving infrastructure, or persistence mechanisms, including suspicious email-forwarding rules.

Why cloud monitoring matters more

Cloud monitoring becomes especially important when AI workloads are involved. Unknown containers, inference jobs, unusual network connections, and sudden resource consumption deserve investigation, even when the underlying account appears legitimate.

Password resets alone may not remove an intruder’s access if cloud persistence remains elsewhere. Teams should review active sessions, tokens, forwarding rules, and newly created workloads after a suspected compromise.

Why this matters for everyday tech

The security implications extend beyond the organizations targeted in the UNC6508 campaign. Developers, creators and smaller organizations also use cloud accounts, AI assistants and digital development resources that can become valuable targets.

A compromised cloud account can become more than a doorway into stored files. Google has documented attackers using breached cloud environments for computing power, AI services and additional credentials, making strong credential protection and secret management increasingly important.

The defensive clock is shrinking

The biggest operational change may be speed. Traditional intrusions can involve long periods of reconnaissance and manual troubleshooting. AI-assisted workflows can let attackers test, adapt, and deploy tooling much faster once access is established.

That shorter timeline changes what effective defense requires. Organizations need to identify abnormal cloud activity quickly, restrict unnecessary permissions, and protect AI-related credentials as carefully as production secrets.

AI is now both weapon and prize

Google’s report presents artificial intelligence as both an accelerator for cyber operations and a valuable target. PRC-linked threat actors have used AI for reconnaissance, exploit development, social engineering and post-exploitation tasks, while UNC6508 has specifically targeted proprietary AI research.

Other threat actors have also stolen models, source code, prompts and related AI assets. Together, the findings show that AI is becoming both a capability attackers can use and a resource they may try to steal.

TL;DR

• China-linked hackers are increasingly deploying AI models inside compromised cloud environments. This lets them use stolen computing resources while reducing reliance on commercial AI services.
• UNC6508 has targeted North American academic, medical and military research organizations and has shown particular interest in proprietary AI research. Some of its intrusions remained undetected for more than a year.
• Agentic AI can automate reconnaissance, exploit development, and credential theft. This reduces the time attackers need to complete complex operations from days to hours.
• Defenders should investigate unexpected high-performance computing activity, unfamiliar cloud workloads, unusual infrastructure growth and exposed AI credentials. Compromised compute can itself become an attack resource.

This article was made with AI assistance and human editing.

If you liked this, you might also like: