UK cyber agency probes China-linked hacking campaign that used AI agents

What the UK is investigating

Britain's National Cyber Security Centre (NCSC), an arm of the GCHQ intelligence agency, is urgently looking into a hacking campaign linked to Beijing, as Yahoo reported. The worry is that sensitive secrets may have been taken. The agency is understood to be working with Microsoft and others to establish whether British organisations were affected by a group Microsoft calls Storm-0940.

Microsoft described the group as aligned with the Chinese state and said it had uncovered a global campaign last week. Hundreds of organisations were targeted, spanning defence, energy, finance, government and technology.

The ConnectWise breach

One confirmed victim is ConnectWise, a US company whose cloud service helps big organisations back up their Microsoft 365 email and files. This is a supply-chain attack: instead of attacking many customers one by one, hackers go after a supplier many of them rely on. ConnectWise has told Britain's data watchdog, the Information Commissioner's Office, which is now assessing the breach.

The company suspended its services. It says it has seen no sign that stored backups were compromised. But it also warned that turning the service off does not cancel any access the attackers already obtained inside individual customers' systems. Those customers need to review their own setups separately, according to chief executive Manny Rivelo.

How AI sped the attackers up

Microsoft says the group has used AI in its attacks since at least September. In some cases it got into an organisation's cloud systems in less than three hours. Microsoft's researchers pointed out that AI agents, which are programs that carry out tasks on their own, do not tire. They can work nights, weekends and holidays, and can try several routes into a target at the same time.

The group reportedly relied on a tool called Artex. A Chinese developer released it publicly in July as open-source software, meaning anyone can download and change it for free. It links existing hacking tools to AI agents. A user names a target and a goal, and the agents then try whatever methods they can find.

Prof Alan Woodward of Surrey University said the tool essentially compresses work that human penetration testers, who are paid to probe systems for weaknesses, used to do by hand.

A tool that spread beyond its purpose

Artex was nominally meant for research and drew real interest from security specialists. It also won an award from Baidu before its public release. Even so, it has reportedly been used against South Korean banks and companies in Japan.

The developer took it offline in October. By then more than 12,000 people had copied it, so removing the original did little to stop its use.

A bad week for the web, and the UK response

The campaign arrives during a run of AI-assisted attacks. Millions of hacking attempts hit websites worldwide after AI agents found a flaw in PHP, a programming language behind about 70pc of the world's websites. Governments and companies took sites offline so they could fix the problem first. Experts said the flaw could only be exploited with AI, which raises fears that more such weaknesses will surface.

Jason Clinton, deputy chief information security officer at Anthropic, said problems would get "a lot worse before they get better". Nothing in the reporting links this campaign to Anthropic or any other AI vendor.

On Saturday, UK ministers announced hundreds of millions of pounds for AI security. £60m will fund a National Cyber Shield that uses agentic AI to strengthen defences. A further £70m will go to AI tools that find vulnerabilities across critical infrastructure and the wider economy.

What is still unknown

The investigation is at an early stage. The reporting does not say whether any British organisation was actually breached, how much data may have been taken, or how many ConnectWise customers are affected. Those answers will shape how serious this turns out to be for the UK.