Cases › security breach › LR-2026-0364

Kuaishou livestream platform hit by AI-assisted bot attack

Preliminary Why: Publisher not yet named · subject to change

Status: action reported, no fix

Severity moderate

Reported 24 Dec 2025

Industry short-video platform

No source states: loss or records, developer and model, agent tool, could do, deployer.

Severity moderate: Test: data or systems of others touched with a bounded scope stated. The sources state user data was compromised and that the scope was the livestreaming section, with all other services unaffected.

Kuaishou, a Chinese short-video platform, reported an attack on its livestreaming section in which bot accounts flooded the service with illicit streams. According to reports, about 17,000 bot accounts broadcast pornographic and violent material during a 90-minute siege that bypassed security systems and compromised user data. Experts said the attackers likely used automated tools to solve CAPTCHAs and generated the streams with AI-made faces or looped recordings. Kuaishou shut down all livestreaming channels, which also cleared legitimate content, and later restored the function after system repairs. The company said it reported the incident to regulators and public security authorities.

What happened

1 · What went wrongThe attack overwhelmed the moderation defences, with prerecorded explicit and violent videos.

2 · What it reached or didAttackers deployed about 17,000 bot accounts to broadcast pornography and violent material.

3 · How it was caughtKuaishou shut down all livestreaming channels as violations escalated.

What was done

After extensive repairs, the livestreaming function was restored and other services were stated to be unaffected.

Risks

AI used to run a cyber attack
Primary96 incidents
Rising: 24 vs 4.0 a week

Read from the sources; not yet reviewed by a person.

Controls

Model

Not effective Content safety classifiers

Harness

Effective Stop control

Infrastructure / target

Not effective (bypassed) Bot and scraping defences

Control failure chain

L1 · Model Not effectiveProvider not named

L2 · Harness EffectiveHarness not named

L3 · Application Attacker's ownThe attacker

L4 · Infrastructure / target Not effective (bypassed)Organisation hit

L1 · ModelProvider not namedModel provider

Not effectiveContent safety classifiers“The company said in a statement on Tuesday that the attack overwhelmed Kuaishou's moderation defenses, with assailants using prerecorded videos containing explicit and violent content.”China Daily Global Edition

Model version not linked to a model card.

Other controls for this risk at this layer, not mentioned in the sources: Safety training and refusal, Cyber and weapons safeguards, Abuse monitoring and account enforcement, Staged or restricted release, Dangerous-capability testing before release, Outside red-teaming, Safeguards kept on in testing, Reasoning monitoring.

L2 · HarnessHarness not namedAgent framework vendor

EffectiveStop control“Faced with the escalating violations, Kuaishou initiated a blanket shutdown of all livestreaming channels.”China Daily Global Edition

L3 · ApplicationThe attackerDeployer

The attacker ran the agent; this layer was the attacker's own.

L4 · Infrastructure / targetOrganisation hit

Not effective (bypassed)Bot and scraping defences“They likely employed automated services to solve CAPTCHA puzzles — those 'prove you're human' tests — and hid their locations using networks of hacked home devices," Fong said.”China Daily Global Edition

Other controls for this risk at this layer, not mentioned in the sources: Known flaws patched, Multi-factor sign-in and password policy, Network segmentation, Intrusion and endpoint detection, Backups and recovery, Phishing and fraud filters.

EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target

Controls for this risk: result in this incident

Control	Part of the system	Result
Content safety classifiers	L1 Model	Not effective
Safety training and refusal	L1 Model	Not stated in sources
Cyber and weapons safeguards	L1 Model	Not stated in sources
Dangerous-capability testing before release	L1 Model	Not stated in sources
Outside red-teaming	L1 Model	Not stated in sources
Staged or restricted release	L1 Model	Not stated in sources
Abuse monitoring and account enforcement	L1 Model	Not stated in sources
Reasoning monitoring	L1 Model	Not stated in sources
Safeguards kept on in testing	L1 Model	Not stated in sources
Stop control	L2 Harness	Effective
Bot and scraping defences	L4 Infrastructure / target	Not effective (bypassed)
Known flaws patched	L4 Infrastructure / target	Not stated in sources
Multi-factor sign-in and password policy	L4 Infrastructure / target	Not stated in sources
Network segmentation	L4 Infrastructure / target	Not stated in sources
Intrusion and endpoint detection	L4 Infrastructure / target	Not stated in sources
Backups and recovery	L4 Infrastructure / target	Not stated in sources
Phishing and fraud filters	L4 Infrastructure / target	Not stated in sources

Evidence

Cause a safeguard that was in place did not hold

No source states: what the AI was doing, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, what set it off.

Show the full account: 8 items from the primary sources

What happened, in order

Not dated in the sources:

The coordinated assault began.
Attackers deployed about 17,000 bot accounts to broadcast pornography and violent material.
Kuaishou initiated a blanket shutdown of all livestreaming channels.
The livestreaming section appeared cleared out, including legitimate content.
Kuaishou stated the attack overwhelmed its moderation defences.
Kuaishou confirmed it had been maliciously targeted by cybercriminal groups and that emergency measures were taken.
Kuaishou restored its livestreaming function after extensive system repairs.
Kuaishou reported the incident to relevant regulators and public security authorities.

Show every field, with its source and grade

What happened

Earliest source we hold

2025-12-24

D inferred by us from the described behaviour, reason shown

How long it lasted

PT1H30M

C one secondary source states it

Cause

a safeguard that was in place did not hold

C one secondary source states it

Cause in detail

Content moderation defences were overwhelmed by the attack, which used prerecorded explicit and violent videos.

C one secondary source states it

Who caused it

an outside attacker

C one secondary source states it

What went wrong

security breach

C one secondary source states it

primary risk

RK07

D inferred by us from the described behaviour, reason shown

control chain

layer: L4; party: target; control id: J5; outcome: got around; quote: They likely employed automated services to solve CAPTCHA puzzles — those 'prove you're human' tests — and hid their locations using networks of hacked home devices," Fong said.; source index: 0, layer: L1; party: provider; party name: Kuaishou; control id: C5; outcome: failed; quote: The company said in a statement on Tuesday that the attack overwhelmed Kuaishou's moderation defenses, with assailants using prerecorded videos containing explicit and violent content.; source index: 0, layer: L2; party: harness vendor; party name: Kuaishou; control id: B3; outcome: held; quote: Faced with the escalating violations, Kuaishou initiated a blanket shutdown of all livestreaming channels.; source index: 0

C one secondary source states it

Impact

Severity

moderate

D inferred by us from the described behaviour, reason shown

Kind of harm

operations, privacy

C one secondary source states it

Why this severity

Test: data or systems of others touched with a bounded scope stated. The sources state user data was compromised and that the scope was the livestreaming section, with all other services unaffected.

D inferred by us from the described behaviour, reason shown

Context

Industry

short-video platform

C one secondary source states it

Country

China

C one secondary source states it

Notes on gaps

The sources describe an attack by cybercriminals using automated bots, CAPTCHA-solving services and AI-generated faces. Reversibility is not stated.

LR-2026-0364 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON