# Hackers Use Autonomous AI Agents to Breach Over 1,200 Websites in Chinese‑Language Campaign

*Tuesday, October 20, 2026 at 4:07 PM UTC — Hamer Intelligence Services Desk*

**Published**: 2026-10-20T16:07:11.370Z (2h ago)
**Category**: cyber | **Region**: Global
**Importance**: 9/10
**Sources**: OSINT
**Permalink**: https://hamerintel.com/data/articles/21067.md
**Source**: https://hamerintel.com/summaries

---

**Deck**: Researchers say a Chinese‑language hacking campaign used autonomous AI agents to target more than 1,200 websites, with exposed control panels revealing confirmed compromises and leaked secrets.

A Chinese-language hacking campaign has used autonomous AI agents to attack more than 1,200 websites, giving security teams an early look at how off‑the‑shelf automation can scale up intrusion attempts.

According to technical reporting, the attackers deployed AI agents to probe and compromise websites with minimal human input. Exposed control panels for the AI tools showed confirmed breaches and hundreds of leaked secrets taken from victim systems.

The campaign still relies on familiar techniques—scanning for vulnerable web applications, misconfigurations and weak authentication—but shifts much of the work from human operators to software that can chain tasks together.

Security researchers warn that this kind of automation makes it easier for a small group of attackers to run large numbers of operations in parallel, which is especially dangerous for organizations with limited defensive staff.

The trend comes as other cyber threats continue to exploit known flaws. A public proof-of-concept exploit has been released for a critical vulnerability in Fortinet FortiSIEM, tracked as CVE‑2026‑106173 with a CVSS score of 9.4. The flaw enables unauthenticated remote code execution by chaining path traversal and NUL-byte injection to overwrite files.

Separately, ransomware groups Qilin and INC are still abusing a patched Palo Alto Networks vulnerability, CVE‑2026‑0257, to gain access to corporate networks and bypass multi-factor authentication for VPN sessions. In at least one case, attackers pivoted to VMware ESXi and dumped domain credentials.

The combination of widely available exploits for major enterprise products and AI agents that can automate reconnaissance and attack steps points to a rising risk for unpatched or poorly monitored systems.

Companies’ responses—how quickly they patch exposed software, monitor for AI-driven attack patterns and invest in their own automated defenses—will determine how much advantage these new tools give to attackers.