--- title: DeepSeek Is Becoming the AI of Choice for Cybercriminals description: Security researchers say hackers are turning to DeepSeek because open-weight models are cheap, capable and impossible to govern like a closed API. author: Darie Nani (Editor-in-Chief) updated: 2026-08-25T15:18:05.544Z canonical: https://www.sovereignmagazine.com/article/deepseek-is-becoming-the-ai-of-choice-for-cybercriminals categories: Artificial Intelligence content_type: Analysis region: Global publication: Sovereign Magazine schema_type: Article --- Researchers who study how criminals put artificial intelligence to work keep arriving at the same name. DeepSeek, the open-weight model released by a Chinese startup, is turning up inside working attack tools, in red-team labs that break its safety controls on the first attempt, and in the threat reports of firms that track state-linked hacking. Together the reports point to the same shift: a barrier has fallen. Capable AI is now cheap, downloadable and largely unguarded, and within reach of anyone who wants to point it at a target. DeepSeek was founded in 2023 by Liang Wenfeng, out of the Chinese quantitative hedge fund High-Flyer, and is based in Hangzhou. It releases its models, including V3 and R1, as open weights under a permissive license, with no API gatekeeping. Anyone can download them and run them on their own machine. That design choice, more than any single security lapse, is what security researchers now point to. ## A Chinese-Speaking Group Ran DeepSeek Inside an Automated Attack Tool In a report published on July 30, 2026, the Unit 42 threat-intelligence team at Palo Alto Networks described a Chinese-speaking threat actor who [wired DeepSeek into an offensive agent framework](https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/) the attacker called the Hermes Agent. Operated over Telegram, the system scanned for and tried to exploit vulnerable machines on its own. Unit 42 says it attempted more than 460 targets and confirmed 14 compromises, three through a Citrix vulnerability and eleven through a flaw in a tool called Marimo. The reach outran the results. Unit 42 characterized the campaign as having limited impacts, and reported that most of the exploitation attempts were stopped by ordinary target-side security rather than by any limit of the tool itself. Fully autonomous AI attacks remain fragile. The clearest advantage the technology hands an attacker is volume, cheaper attacks run at scale, rather than a leap in sophistication that ordinary defenses cannot meet. ## In the Same Campaign, Claude Refused the Task and OpenAI Disabled the Account The same report recorded what happened when the attacker reached for commercial models instead. Unit 42 says the attempt to use Anthropic's Claude was refused, with the model's permissions disabled, and that OpenAI's provider-side controls flagged and disabled the account tied to the campaign. That is the practical difference between a closed API and an open-weight release. A hosted model sits behind a company that can watch how it is used and cut off an account. An open-weight model publishes its parameters to the world, so anyone can remove the safety fine-tuning and run the result locally, on hardware no provider controls. There is no account to suspend and no switch anyone can throw from the outside. Every frontier model can be jailbroken to some degree, and the Unit 42 findings do not suggest Claude or OpenAI are immune. The difference researchers stress is structural: provider-side safety showed measurable defensive value in this real campaign, and an open-weight model cannot offer it by design. ## Benchmark Tests Break DeepSeek's Safety Controls Far More Easily Than Its Rivals' Independent testing has found DeepSeek unusually easy to push. Cisco's security researchers ran the HarmBench jailbreak set against a range of models and reported that [DeepSeek R1 gave a 100 percent attack success rate](https://blogs.cisco.com/security/evaluating-security-risk-in-deepseek-and-other-frontier-reasoning-models), the worst in its class. On the same test, Cisco put Anthropic's Claude 3.5 at 36 percent and OpenAI's o1-preview at 26 percent, with GPT-4o at 86 percent, Google's Gemini 1.5 at 64 percent, and Meta's Llama 3.1 at 96 percent. None of the models scored zero, which is Cisco's own reminder that jailbreaking is a general weakness, but DeepSeek sat at the far end of it. The red-team firm KELA Cyber pushed further into practical harm. KELA reported that a jailbreak technique already patched in GPT-4 and GPT-4o still worked on DeepSeek R1, and used it to make the model produce infostealer malware designed to harvest login credentials. ## Export Controls Aim at Chips, Not at Model Weights Already in Circulation The Taiwanese cybersecurity firm TeamT5 says the shift is already visible in its own data. It reports that Chinese state-linked hacking groups have adopted DeepSeek for reconnaissance and exploit generation, and that it has watched attack volumes roughly double, a figure TeamT5 says comes from its own count. Charles Li, the firm's chief analyst, said DeepSeek is "the AI of choice for Chinese hackers because it's relatively powerful with very low cyber guardrails." That leaves policymakers with a problem their current tools were not built for. Export controls are aimed at hardware, at the advanced chips needed to train and run large models. Model weights are files. Once released under a permissive license, they can be copied, downloaded, and run anywhere, and they slip past controls written for silicon. The campaigns raise a question that reaches past DeepSeek to the whole category it belongs to. A closed service can be governed by the company that runs it. An open-weight model, once it is out, cannot be recalled, and no one has yet offered a policy answer for what that means as the models keep getting better. ## FAQ **Q: What is an open-weight AI model?** It is a model whose trained parameters, the numerical weights that make it work, are published for anyone to download. Unlike a service such as ChatGPT or Claude, which you reach through a company's servers, an open-weight model can be run on your own hardware with no account and no provider watching. DeepSeek releases its V3 and R1 models this way under a permissive license. **Q: What is a jailbreak?** A jailbreak is a prompt or technique that gets an AI model to ignore its own safety rules and produce content it was trained to refuse, such as malware or attack instructions. The Cisco and KELA tests cited above are jailbreak experiments. Cisco found DeepSeek R1 gave in every time on its test set, and KELA used a jailbreak that other vendors had already patched. **Q: Is DeepSeek uniquely dangerous compared with other AI models?** No model is exempt. Cisco's testing showed every system it checked could be jailbroken to some degree, including Claude and OpenAI's o1-preview. DeepSeek stands out for scoring worst on those tests and for being open-weight, which means its safety controls can be removed and the model run beyond any provider's reach. **Q: How much real damage have these AI-assisted attacks done so far?** Less than the alarm around them suggests. In the campaign Unit 42 documented, 14 compromises were confirmed out of more than 460 targets, and most attempts were stopped by routine defenses. Researchers say the main advantage AI gives attackers today is volume and lower cost, not attacks that ordinary security cannot handle. **Q: Can regulators or export controls stop this?** The main US lever, export controls, targets advanced chips rather than models. Model weights are files that can be copied and run anywhere once released, so they fall outside controls designed for hardware. Security researchers say there is no settled policy answer yet for governing capable models that anyone can download.