{"schema_version":"0.10.0","id":"LR-2026-0364","record_version":1,"title":"Kuaishou livestream platform hit by AI-assisted bot attack","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":45.2,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":0.0,"completeness":4.8,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"Publisher not yet named · subject to change","original_document":null,"reports_total":1,"reports_independent":0,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"preliminary","reason":"Publisher not yet named · subject to change"}]},"sources_hash":"ec36edea191301c190567e0989cfd0237fea80a46d823f33931c15511dda57ad"},"system":{"model_name":null,"model_version":null,"developer":"unknown","harness":null,"tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2025-12-24","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":"PT1H30M","detection_method":"unknown","summary":"Kuaishou, a Chinese short-video platform, reported an attack on its livestreaming section in which bot accounts flooded the service with illicit streams. According to reports, about 17,000 bot accounts broadcast pornographic and violent material during a 90-minute siege that bypassed security systems and compromised user data. Experts said the attackers likely used automated tools to solve CAPTCHAs and generated the streams with AI-made faces or looped recordings. Kuaishou shut down all livestreaming channels, which also cleared legitimate content, and later restored the function after system repairs. The company said it reported the incident to regulators and public security authorities.","tags":[],"date_detected":null,"near_miss":null,"root_cause":"guardrail","root_cause_detail":"Content moderation defences were overwhelmed by the attack, which used prerecorded explicit and violent videos.","failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":null,"primary_risk":"RK07","control_chain":[{"layer":"L4","party":"target","party_name":null,"control_id":"J5","outcome":"got_around","reason":null,"quote":"They likely employed automated services to solve CAPTCHA puzzles — those 'prove you're human' tests — and hid their locations using networks of hacked home devices,\" Fong said.","source_index":0,"reviewed":false},{"layer":"L1","party":"provider","party_name":"Kuaishou","control_id":"C5","outcome":"failed","reason":null,"quote":"The company said in a statement on Tuesday that the attack overwhelmed Kuaishou's moderation defenses, with assailants using prerecorded videos containing explicit and violent content.","source_index":0,"reviewed":false},{"layer":"L2","party":"harness_vendor","party_name":"Kuaishou","control_id":"B3","outcome":"held","reason":null,"quote":"Faced with the escalating violations, Kuaishou initiated a blanket shutdown of all livestreaming channels.","source_index":0,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Test: data or systems of others touched with a bounded scope stated. The sources state user data was compromised and that the scope was the livestreaming section, with all other services unaffected.","harm_class":["operational","privacy"],"affected_description":null,"protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://global.chinadaily.com.cn/a/202512/24/WS694b3af5a310d6866eb3026d.html","publisher":"China Daily Global Edition","date":"2025-12-24","type":"press","title":"AI-powered cyberattack on Kuaishou exposes need to bolster defenses - China Daily Global Edition","archived_url":null,"attachment":"first_report"}],"per_field_confidence":{"context.country":"C","context.industry":"C","event.incident_class":"C","event.adversarial_actor":"C","event.duration":"C","event.root_cause":"C","event.root_cause_detail":"C","impact.harm_class":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.control_chain":"C","event.summary":"C","system.autonomy_level":"D","system.deployment_context":"D","event.trigger":"D","event.detection_method":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"context.country":[{"source_index":0,"quote":"A massive, artificial intelligence-powered cyberattack has exposed critical vulnerabilities in the content moderation systems of the Chinese short-video platform Kuaishou, experts warned on Tuesday after the platform was flooded by tens of thousands of illicit livestreams."}],"context.industry":[{"source_index":0,"quote":"A massive, artificial intelligence-powered cyberattack has exposed critical vulnerabilities in the content moderation systems of the Chinese short-video platform Kuaishou, experts warned on Tuesday after the platform was flooded by tens of thousands of illicit livestreams."}],"event.incident_class":[{"source_index":0,"quote":"Kuaishou confirmed in a statement on Tuesday that it had been maliciously targeted by cybercriminal groups and that emergency measures were taken to address the breach."}],"event.adversarial_actor":[{"source_index":0,"quote":"Industry analysis indicates that the incident was a highly coordinated, premeditated external attack."}],"event.duration":[{"source_index":0,"quote":"The coordinated 90-minute siege bypassed security systems and compromised user data, forcing a total shutdown of the app's livestreaming section, according to the cybersecurity firm Qi-Anxin, which tracked the onslaught."}],"event.root_cause":[{"source_index":0,"quote":"The company said in a statement on Tuesday that the attack overwhelmed Kuaishou's moderation defenses, with assailants using prerecorded videos containing explicit and violent content."}],"event.root_cause_detail":[{"source_index":0,"quote":"The company said in a statement on Tuesday that the attack overwhelmed Kuaishou's moderation defenses, with assailants using prerecorded videos containing explicit and violent content."}],"impact.harm_class":[{"source_index":0,"quote":"The coordinated 90-minute siege bypassed security systems and compromised user data, forcing a total shutdown of the app's livestreaming section, according to the cybersecurity firm Qi-Anxin, which tracked the onslaught."}],"impact.severity":[{"source_index":0,"quote":"Following extensive system repairs, Kuaishou restored its livestreaming function and said that all other services remain unaffected."}],"impact.severity_because":[{"source_index":0,"quote":"Following extensive system repairs, Kuaishou restored its livestreaming function and said that all other services remain unaffected."}],"event.control_chain":[{"source_index":0,"quote":"They likely employed automated services to solve CAPTCHA puzzles — those 'prove you're human' tests — and hid their locations using networks of hacked home devices,\" Fong said."},{"source_index":0,"quote":"The company said in a statement on Tuesday that the attack overwhelmed Kuaishou's moderation defenses, with assailants using prerecorded videos containing explicit and violent content."},{"source_index":0,"quote":"Faced with the escalating violations, Kuaishou initiated a blanket shutdown of all livestreaming channels."}],"event.summary":[{"source_index":0,"quote":"On Monday night, attackers deployed approximately 17,000 bot accounts to broadcast pornography, and violent material."},{"source_index":0,"quote":"The coordinated 90-minute siege bypassed security systems and compromised user data, forcing a total shutdown of the app's livestreaming section, according to the cybersecurity firm Qi-Anxin, which tracked the onslaught."},{"source_index":0,"quote":"They likely employed automated services to solve CAPTCHA puzzles — those 'prove you're human' tests — and hid their locations using networks of hacked home devices,\" Fong said."},{"source_index":0,"quote":"Faced with the escalating violations, Kuaishou initiated a blanket shutdown of all livestreaming channels."},{"source_index":0,"quote":"Following extensive system repairs, Kuaishou restored its livestreaming function and said that all other services remain unaffected."},{"source_index":0,"quote":"The company said it has reported the incident to relevant regulators and public security authorities and will pursue legal remedies to safeguard its interests and those of its shareholders."}]},"notes_on_gaps":"The sources describe an attack by cybercriminals using automated bots, CAPTCHA-solving services and AI-generated faces. No autonomous AI agent is described as involved, so event.agent_involved and all failure_class fields are left out. Exact date of occurrence is not stated: the attack was on a Monday and statements came on Tuesday, with an article dated 2025-12-24, but no calendar date is given, so date_occurred and date_disclosed are left out rather than inferred. Detection method is not clearly stated (Qi-Anxin tracked the onslaught, but who first caught it is unclear), so it is left out. Trigger is not stated and is left out. Responsible party is not stated and is left out. The number of users or records exposed and the type of user data compromised are not stated. Reversibility is not stated. The system fields (model, developer, harness) are not described in the sources and are left out; deployment_context production is inferred from the livestreaming platform being live. Remediations list only the shutdown, which is the one change the sources describe with a control mapping (B3); the repairs are not tied to a named control. The 90-minute duration is taken from the source's stated siege length. Root cause as guardrail is a judgement: the sources say the moderation defences were overwhelmed. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Preliminary (Publisher not yet named · subject to change)]"},"context":{"industry":"short-video platform","org_size_band":null,"country":"CN","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"The attack overwhelmed the moderation defences, with prerecorded explicit and violent videos.","quote":"The company said in a statement on Tuesday that the attack overwhelmed Kuaishou's moderation defenses, with assailants using prerecorded videos containing explicit and violent content.","source_index":0,"grade":"C"},{"step":"reached","text":"Attackers deployed about 17,000 bot accounts to broadcast pornography and violent material.","quote":"On Monday night, attackers deployed approximately 17,000 bot accounts to broadcast pornography, and violent material.","source_index":0,"grade":"C"},{"step":"caught","text":"Kuaishou shut down all livestreaming channels as violations escalated.","quote":"Faced with the escalating violations, Kuaishou initiated a blanket shutdown of all livestreaming channels.","source_index":0,"grade":"C"},{"step":"done","text":"After extensive repairs, the livestreaming function was restored and other services were stated to be unaffected.","quote":"Following extensive system repairs, Kuaishou restored its livestreaming function and said that all other services remain unaffected.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://global.chinadaily.com.cn/a/202512/24/WS694b3af5a310d6866eb3026d.html"]},"analysis":{"sections":{"timeline":[{"text":"The coordinated assault began.","quote":"The coordinated assault, which began at around 10 pm on Monday, underscores that human reviewers alone are no match for automated attacks.","source_index":0,"when":"Monday, around 10 pm"},{"text":"Attackers deployed about 17,000 bot accounts to broadcast pornography and violent material.","quote":"On Monday night, attackers deployed approximately 17,000 bot accounts to broadcast pornography, and violent material.","source_index":0,"when":"Monday night"},{"text":"Kuaishou initiated a blanket shutdown of all livestreaming channels.","quote":"Faced with the escalating violations, Kuaishou initiated a blanket shutdown of all livestreaming channels.","source_index":0,"when":null},{"text":"The livestreaming section appeared cleared out, including legitimate content.","quote":"By midnight, the platform's livestreaming section appeared cleared out — including legitimate content.","source_index":0,"when":"By midnight"},{"text":"Kuaishou stated the attack overwhelmed its moderation defences.","quote":"The company said in a statement on Tuesday that the attack overwhelmed Kuaishou's moderation defenses, with assailants using prerecorded videos containing explicit and violent content.","source_index":0,"when":"Tuesday"},{"text":"Kuaishou confirmed it had been maliciously targeted by cybercriminal groups and that emergency measures were taken.","quote":"Kuaishou confirmed in a statement on Tuesday that it had been maliciously targeted by cybercriminal groups and that emergency measures were taken to address the breach.","source_index":0,"when":"Tuesday"},{"text":"Kuaishou restored its livestreaming function after extensive system repairs.","quote":"Following extensive system repairs, Kuaishou restored its livestreaming function and said that all other services remain unaffected.","source_index":0,"when":null},{"text":"Kuaishou reported the incident to relevant regulators and public security authorities.","quote":"The company said it has reported the incident to relevant regulators and public security authorities and will pursue legal remedies to safeguard its interests and those of its shareholders.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://global.chinadaily.com.cn/a/202512/24/WS694b3af5a310d6866eb3026d.html"]}}