GoKawiilA DeepSeek AI agent attacked the network of a cybersecurity firm as part of a proxyjacking campaign, spurring the firm to set a trap and take control of the agent.
The attack, observed and then intercepted by Tel Aviv-based AI cybersecurity firm Jesta Security, marks the the latest example of AI agents attacking third-party networks in recent weeks, according to a report published today. But in contrast to the OpenAI model attack on Hugging Face during a benchmark test — the inadvertent result of the large language model (LLM) trying to find the best way to solve a problem — this attack was intentional, Aviv Halfon, co-founder and CEO at Jesta, tells Dark Reading.
"A human threat actor with malicious intent deliberately weaponized an AI model to run an agentic attack campaign end to end," he says. However, the goal wasn't to steal, encrypt, or modify anything on the system, but to build infrastructure for more attacks. "The attacker was using our compromised environment to stage its next operations," Halfon says.
Related:Who's Liable When AI Agents Escape? Hugging Face Breach Raises Hard Questions
Jesta also was able to identify the attacker as an AI model and track its activities to understand the origin and nature of the attack. "Unlike the OpenAI incident, the discovery and knowledge about this campaign came from the defender's side," Halfon says.
Moreover, this subsequent investigation revealed "strong indicators" that a Chinese threat actor is behind the weaponization of the model, including activity tied to a Beijing time zone as well as the inclusion of Chinese characters in payloads, he says. "These factors point to a Chinese origin," Halfon tells Dark Reading.
The Five-Day Agent Attack
The attack started on "a quiet Thursday," July 2, when Jesta researchers noticed some unusual activity that began scanning their environment in a way that seemed human, "but at super-human speed," according to the post. Jesta is currently in stealth mode and aims to build a defense layer against autonomous AI attacks.
The researchers verified that the activity was not coming from an internal source and suspected it was an AI model. They eventually set up a trap for what by seeding the environment "with a few things a language model cannot ignore, nothing a human would look at twice," and waited to see what it would do in response, according to the report.
Over the course of five days, the model conducted reconnaissance and attempted to profile the target system through hundreds of short-lived SSH sessions, according to Jesta. The activity was characterized by a distinctive pattern: the agent connected, executed a single command, disconnected, and returned after brief pauses to "think." Over the five-day period, researchers recorded 871 sessions, most lasting less than two seconds, they said.
... continue reading