Ghostcat

Hunt.io traces intrusions in four countries to AI agents running eight known exploits

Hunt.io says a Chinese-speaking operator drove Claude Code, Alibaba Qwen and DeepSeek through an orchestration framework called SecFlow, splitting reconnaissance, exploitation and collection among specialist agents that fired only publicly documented exploits.