Telco security teams are used to ridiculous cyber numbers. For example, in the first six months of 2026, Cloudflare blocked 23.2 million network DDoS attacks across its infrastructure. That is about 128,000 attacks every day, or more than 5,300 every hour. It also recorded 935 attacks above one terabit per second during the same period. The volume is so high, and many attacks are so short, that human response became unrealistic years ago.
Telcos face the same reality as the rest of the security industry. Someone is always scanning the network, trying credentials, looking for exposed systems, attacking customers, testing APIs, or targeting suppliers. At the more serious end, state-sponsored attackers have gone after the routers at the heart of telecommunications networks. CISA has documented Chinese state-sponsored actors targeting backbone, provider edge, and customer edge routers at major telecom providers, then using compromised devices and trusted connections to move further into other networks.
Most of these attacks still have one important constraint. The expensive part is intelligent human attention. A botnet can scan ten million IP addresses, but someone still has to determine which result matters, examine the unusual server, link a leaked credential to an old supplier account, study the API documentation, inspect the software package, write an exploit, and decide what to try when the first route fails.
With AI agents supported by Advanced models, that constraint is starting to disappear.
On August 13, Taiwan’s cyber authority disclosed an attack on government organizations in which foreign hackers combined human operators with AI agents. According to the government investigation, the agents rapidly chained different attack methods and used backup and test systems as stepping stones. Taiwan described the new operating model in practical terms: faster attacks, lower cost, and greater scale.
A year ago, an AI swarm sounded like something out of a Matrix sci-fi movie. Only a few months later, it became a software architecture.
Hackers no longer need to choose one path
The biggest change in cyber today is that a hacker no longer has to decide which attack path beforehand. New multi-agent systems can break a large problem into hundreds of smaller investigations and run them in parallel.
Kimi shows how quickly that architecture is developing. Kimi is an AI model and agent platform built by the Chinese company Moonshot AI. Its K2.6 Agent Swarm allows one main agent to coordinate up to 300 subagents working in parallel. The main agent breaks the job into tasks, sends different workers to investigate each one, collects their results, and decides where more work is needed. Moonshot says a single swarm task can generate more than 4,000 tool calls and complete large search tasks about 4.5 times faster than a single agent working sequentially.
Kimi was not built to attack telecom networks. It was built for work such as searching large amounts of information, reading hundreds of documents, and solving complex software problems. But the same architecture maps almost perfectly onto cybersecurity. Instead of asking one agent to find a way into a company, an attacker can give hundreds of agents separate pieces of the problem. Some search for public infrastructure. Some inspect cloud accounts. Some study suppliers. Others look through old software packages, exposed APIs, authentication flows, leaked credentials, configuration files, and development environments. Moonshot’s architecture already lets the main agent create separate workers, each with its own context and tools, and run them in parallel.