「護網—2026」行動、中國執法案例與人工智慧整合之分析

HuWang at Ten: China’s National Cybersecurity Exercise as a Driver of Operational Readiness, Industrial Development, and Cyber Talent

As HuWang marks its tenth anniversary, China’s annual Ministry of Public Security–led cybersecurity exercise has evolved into a major instrument for strengthening national cyber readiness, developing technical talent, and stimulating the domestic cybersecurity industry. It also represents a notable institutional counterpart to the United States’ Cyber Storm exercise.

Each year, tens of thousands of Chinese organizations spend several weeks preparing for cyberattacks that may originate from any direction and occur without advance notice. Participating organizations maintain continuous network monitoring and defensive operations, often on a 24-hour basis, to detect, contain, and respond to simulated intrusions. The exercise is known as HuWang Operation (护网行动, hù wǎng; literally, “protect the network”), or simply HW.

Organized by China’s Ministry of Public Security (MPS), HuWang has expanded from a limited pilot involving selected critical industries into an annual, nationwide cybersecurity stress test.¹ The 2026 exercise, conducted during July and August, marked the program’s tenth anniversary. Over the past decade, its scope, objectives, and operational priorities have evolved in parallel with changes in China’s cybersecurity policies, regulatory requirements, and legal framework. More recent iterations have also placed increasing emphasis on artificial intelligence, both as a source of emerging cyber risk and as a technology for improving threat detection, analysis, and defensive response.

HuWang’s significance extends beyond regulatory compliance or organizational preparedness. The exercise has become an important source of demand for China’s domestic cybersecurity sector, encouraging organizations to move beyond compliance-oriented procurement and invest in operational attack-and-defense capabilities. It has also developed into a central mechanism through which China identifies, trains, evaluates, and mobilizes offensive and defensive cybersecurity personnel at scale. Through repeated exposure to contested network environments, participants gain experience in intrusion detection, incident response, vulnerability management, threat hunting, command-and-control coordination, and sustained defensive operations.

This article examines the characteristics that distinguish HuWang from a conventional penetration test or narrowly scoped cybersecurity exercise. It describes the exercise lifecycle, beginning with months of organizational preparation and progressing through the intensive “wartime” response period and the subsequent post-exercise review. It also compares HuWang with its closest U.S. analogue: the Cybersecurity and Infrastructure Security Agency’s Cyber Storm exercise, whose tenth iteration occurred last week.

The analysis then traces HuWang’s development over the past decade in relation to China’s changing legal, regulatory, technological, and geopolitical environment. Finally, it considers the exercise’s broader effects on China’s cybersecurity ecosystem, including domestic industry growth, cyber-workforce development, operational capability assessment, and the relationship between state-sponsored exercises and China’s wider advanced persistent threat (APT) community.

Public evidence does not verify that artificial intelligence was operationally integrated into HuWang–2026 itself. The Ministry of Public Security–attributed account describes HuWang–2026 as a nationwide cybersecurity, data-security, and information-security program centered on warning, inspection, vulnerability remediation, compliance enforcement, and interorganizational coordination. It does not identify an AI security operations center, large-language-model assistant, autonomous agent, AI-enabled red team, automated scoring system, or AI-directed incident response capability.

AI appears directly in the HuWang record only as part of the threat environment. Jiangsu police reported that malicious actors were using AI in cyberattacks and that these techniques were evolving. This establishes AI as a defensive concern, not as a confirmed HuWang operational capability.

Date: 23 September 2026

Overall conclusion

The ten cases published in connection with the HuWang–2026 special work show that cybersecurity enforcement is addressing an operating system of controls rather than isolated technical defects. Across the cases, the recurring problem was not simply that a router, interface, account, repository, or biometric system presented risk. The more consequential failure was that the responsible organization or individual did not keep the relevant activity within an accountable lifecycle: assets and data were insufficiently classified; access and processing were not bounded by necessity and authorization; known risks were not closed; monitoring did not produce timely decisions; or response and reporting procedures were not executed.

The cases also show several distinct consequence pathways. Weak platform controls enabled telecommunications fraud and unlawful messaging. Deficient data governance contributed to leakage, unauthorized employee use, bulk export, and public repository exposure. Inadequate personal-information governance permitted processing without sufficient notice, safeguards, or—where facial recognition was involved—demonstrated necessity and a non-biometric alternative. One individual case concerned the conversion of vulnerability knowledge into unauthorized, automated activity against third-party systems. These pathways differ, but all connect operational control failure to regulatory exposure and potential harm beyond the affected organization.

This article treats the cases as anonymized public enforcement summaries. Causal assessment is therefore bounded by disclosed facts. The official publication generally does not identify system architecture, data volume, forensic sequence, exact statutory provision, administrative decision, or penalty amount. The legal discussion below maps disclosed conduct to relevant duties and control principles; it does not reconstruct an undisclosed enforcement theory or assign unsupported sanctions. The recommended controls are prospective design priorities, not assertions that every listed safeguard was absent.

Programme context

The Ministry of Public Security announcement describes HuWang–2026 as special work focused on network security, data security, and information security. It operates through the national network and information-security notification mechanism and is intended to strengthen protection and coordinated governance, address prominent risks, remove vulnerabilities and hidden hazards, and investigate administrative cases involving failures to perform protection obligations. The announcement situates this work within protection of critical information infrastructure, important network systems, and data, but it does not establish that any particular system in the ten summaries was critical information infrastructure or processed legally designated important data.

The programme account emphasizes three institutional developments. First, it reports continued development of the policy and regulatory framework, including public-security supervision and inspection measures and jointly issued measures concerning network-data risk assessment and cybersecurity labeling. Second, it describes a national notification and early-warning mechanism intended to support coordination among authorities and improve operators’ targeted protection. Third, it presents enforcement as combining prevention, source governance, investigation, and coordinated response rather than waiting for the most serious harm to occur.

The reported national statistics are substantial. Public-security organs and relevant sector authorities conducted more than 7,900 network- and data-security hazard inspections, identified and rectified 38,000 security hazards and vulnerabilities, publicly identified 652 mobile applications for noncompliant personal-information collection, and investigated 38,000 administrative cases involving failures to perform network-security, data-security, or personal-information-protection obligations. These are national programme totals reported in the announcement; the publication does not provide a denominator, sector distribution, case-resolution breakdown, or methodology that would support trend or prevalence estimates.

The applicable legal architecture is layered. The Cybersecurity Law establishes network-operator duties concerning internal accountability, protections against attack and intrusion, monitoring and record retention, data safeguards, and incident response. The Data Security Law requires classification and grading, full-lifecycle governance, education and training, proportionate technical and other safeguards, risk monitoring, and prompt remediation. The Personal Information Protection Law (PIPL) adds accountability, necessity, transparency, sensitive-personal-information rules, access governance, security measures, deletion, audit, and impact-assessment duties. The Network Data Security Management Regulations integrate these obligations for network-data processing and require management systems, technical protection, incident planning, and response. Recommended standards such as GB/T 22239-2019 and GB/T 43697-2024 can inform control design, but the case summaries do not establish a protection grade, mandatory application, or violation of a particular standards clause.

Cross-case findings

The cases collectively support five findings. First, governance and technical controls fail together. Cases 1, 4, 6, 7, and 10 pair operational events with missing or ineffective policies, training, authorization, or lifecycle oversight. Second, privileged and administrative pathways are recurring points of consequence. Router management functions, administrator accounts, shared terminals, cloud management accounts, and personal public repositories all became control boundaries. Third, monitoring is valuable only when connected to authority and action. Long-term nondetection, missing logs, and failure to activate a plan illustrate different breaks between telemetry, decision-making, containment, and evidence. Fourth, personal-information compliance begins at product design. Notice and security measures cannot cure collection that lacks necessity or a reasonable alternative. Fifth, enforcement can be preventive. The router case resulted in an order to correct even though the announcement reported no serious consequence, while the Qinzhou case reported governance deficiencies without a disclosed breach.

Case	Disclosed proximate failure	Principal consequence pathway and significance
1	Unprotected data handling, incomplete remediation, and unauthorized employee access	Interface and lifecycle weakness led to unapproved use and retention; confidentiality and purpose governance converge.
2	Vulnerable router with exposed management functions	Malware control created a near-miss affecting the network edge; asset and management-plane governance are preventive duties.
3	Abused messaging interface; plan not activated and event not reported	A legitimate outbound capability amplified unlawful messaging; response execution and supervisory accountability matter.
4	Stored-data leak amid missing systems, training, and safeguards	Leakage was associated with organization-wide data-security immaturity, not a disclosed single exploit.
5	Missing protective equipment and logs plus administrator-account weakness	Platform control was converted into telecommunications-fraud capability; auditability is a safety and accountability control.
6	Missing procedures, stored-data safeguards, and recurring training	Personal-information risk existed before any reported breach; compliance must be an operating capability.
7	Persistent unauthorized cloud management account and bulk export	Weak privileged-access and shared-terminal governance enabled confidentiality loss and prolonged nondetection.
8	Unauthorized batch targeting and automated exploitation	Vulnerability knowledge was converted into scalable third-party harm; responsible disclosure is the lawful boundary.
9	Facial recognition as the sole method, without notice, necessity, or safeguards	Product design compelled sensitive biometric processing; minimization, choice, and security must be integrated.
10	Sensitive system material placed in a personal public repository	Convenience bypassed the approved confidentiality boundary; collaboration channels require classification-aware governance.

A practical cross-case control model follows from these findings. Organizations should maintain an authoritative inventory of systems, interfaces, data flows, privileged identities, shared endpoints, and external collaboration channels. They should map each item to an accountable owner, necessary purpose, lawful authority, risk classification, approved access path, logging requirement, retention rule, incident decision path, and evidence of remediation. The Data Security Law’s lifecycle model, PIPL’s risk-calibrated safeguards, the Cybersecurity Law’s network-operation duties, and the Network Data Security Management Regulations all support this integrated approach.

Case 1 — Jiangsu platform operator: unprotected data and unauthorized employee access

Factual narrative

In November 2025, Suqian public-security authorities received a departmental lead concerning an access vulnerability in a local service platform’s data interface. The Jiangsu company responsible for platform construction and operations and maintenance had not taken protection measures for data transmission and storage and had not completely remediated identified vulnerabilities. Employees also accessed and downloaded evaluation data for analysis without authorization. Police imposed an administrative penalty on the company and supervised destruction of personal information retained without authorization. The publication does not establish external compromise, a particular exploit, the data fields or volume, the employees’ precise roles, or a penalty amount.

Analysis

Proximate control failure. The immediate failure combined an unresolved interface vulnerability, inadequate protection of data in transmission and storage, and employee access outside approved authority. The evidence does not identify a missing protocol, encryption method, application-programming-interface feature, database control, or authentication mechanism. The defensible conclusion is therefore that the confidentiality and authorization outcome failed, not that a particular product or technique caused it.

Root governance failure. The reported combination indicates an ineffective end-to-end governance model across development, operations and maintenance, authorized analytics, and retention. Known vulnerabilities were not driven to verified closure, and actual data use was not kept within an approved purpose and minimum necessary scope. The Data Security Law requires full-lifecycle management, training, appropriate safeguards, and prompt remediation when defects or vulnerabilities are found. Where the retained material was personal information, PIPL requires accountable processing, rational operating permissions, security measures, and deletion in specified circumstances.

Consequence pathway. The confirmed outcomes were unauthorized access and download, unauthorized retention of personal information, an administrative penalty, and police-supervised destruction. Unprotected flows and uncontrolled analytical copies can expand the population able to reach data and weaken subsequent control over reuse, onward provision, and deletion. The magnitude of harm cannot be estimated because the announcement does not identify affected persons, sensitivity, disclosure beyond the organization, or individual injury.

Regulatory and technical significance. The case demonstrates that a platform builder and operations provider must govern vulnerability remediation, data protection, workforce access, analytics, and disposal as one lifecycle. It does not establish that the platform processed important data, was critical information infrastructure, or had a particular controller–processor arrangement. Legal principles explain the control duties but do not reveal the authority’s undisclosed charging provision.

Corrective priorities. The operator should verify containment and lawful disposal while preserving necessary evidence; map the relevant interface, repositories, fields, purposes, owners, recipients, and retention rules; close the vulnerability through accountable remediation and retesting; apply risk-appropriate protection in transit and at rest; and rebuild staff access around named identities, necessity, least privilege, time-bounded authorization, export approval, and reviewable records. Legitimate analysis should use de-identified or aggregated data where that meets the purpose.

Case 2 — Wuhu unit: vulnerable router and exposed management functions

Factual narrative

In April 2026, Wuhu public-security authorities received a lead concerning abnormalities and security risks at an IP address independently used by a local unit for a communications network. The associated router had an unspecified vulnerability and exposed management ports and other functions, which resulted in malware control of the device. Authorities handled the matter promptly; the announcement reports no serious consequences and states that the unit was ordered to correct the issue. It does not identify the unit, router, vulnerability, management service, malware, exposure path, data effect, legal provision, or sanction beyond the correction order.

Analysis

Proximate control failure. A vulnerable router and open management functions existed at the same network edge. This combination created unmanaged administrative attack surface and resulted in malware control. The summary does not establish whether the management functions were internet-reachable, how authentication operated, or how the malware gained control.

Root governance failure. The coexistence of a known or discoverable device weakness and unnecessary or insufficiently restricted management capability indicates ineffective ownership of network-appliance lifecycle and exposure decisions. This is an analytical inference. The notice does not prove that patching policy, procurement controls, firewall rules, monitoring, or an incident plan was absent.

Consequence pathway. Malware controlled the router, but timely handling prevented any consequence characterized by the authority as serious. Router control can threaten availability and the confidentiality and integrity of traffic, and it can create an onward-risk pathway. None of those further outcomes is reported here; there is no disclosed data compromise, traffic manipulation, lateral movement, outage, or loss.

Regulatory and technical significance. The Cybersecurity Law requires network operators to maintain internal responsibility, use technical measures against malware and intrusion, monitor network operation and security events, and address vulnerabilities and incidents through an emergency process. GB/T 22239-2019 is a current recommended baseline for classified cybersecurity protection, but the case gives no protection grade or standards assessment. The lesson is preventive: each management exposure should be necessary, restricted, monitored, and periodically revalidated.

Corrective priorities. The unit should preserve relevant records, remove unauthorized control, restore a supported known-good configuration or replace the device, and validate security before normal operation. It should maintain a device register covering ownership, model, firmware, support status, exposure, and exception state; disable unnecessary management functions; limit retained administration to approved paths and named privileged identities; and monitor configuration change and security events. Equivalent devices and inherited configuration templates should be reviewed, not only the affected address.

Case 3 — Nanchang credit center: abused messaging interface and unexecuted incident response

Factual narrative

In January 2026, Nanchang public-security authorities found that a local credit center’s messaging platform was sending large volumes of unlawful messages. Wrongdoers used the SMS interface of a mini-program operated by the center to send more than 140,000 gambling-related messages to more than 70,000 mobile-phone numbers. The center neither activated its emergency plan nor reported to the relevant authorities as required. Public-security authorities imposed administrative penalties on the center and its responsible supervisory personnel. The notice does not say that the center authored the messages, nor does it identify an intrusion method, vendor, duration, delivery rate, recipient loss, statutory provision, or penalty amount.

Analysis

Proximate control failure. The immediate operational failure was continued misuse of an outbound messaging function, followed by non-activation of the emergency plan and non-reporting. The publication establishes the misuse and response omissions; it does not establish an application-programming-interface flaw, credential compromise, rate-control defect, or supplier failure.

Root governance failure. The response system was not operationally effective. A plan that is not activated during high-volume unlawful use may reflect unclear decision authority, inadequate escalation criteria, weak monitoring-to-decision integration, insufficient rehearsal, or a combination of these factors. The record does not distinguish among them. It does support the narrower conclusion that the event did not produce timely, accountable escalation and external notification.

Consequence pathway. A legitimate messaging capability amplified gambling-related unlawful content to the reported scale. Continued misuse could increase exposure to gambling solicitation and associated fraud risk, consume communications and enforcement resources, and damage trust in the sender environment. The case does not establish that recipients read the messages, gambled, suffered fraud, or sustained financial loss.

Regulatory and technical significance. Cybersecurity Law Article 27 requires an emergency plan, timely treatment of vulnerabilities and attacks, immediate plan activation when a harmful event occurs, remedial action, and reporting as prescribed. The national incident-reporting measures, effective before the case, define reporting routes and timing for events assessed as relatively major or above and require a post-disposal summary, while suspected crimes must be reported promptly. The public case does not identify the event classification or applicable deadline, so neither should be inferred.

Corrective priorities. The center should define measurable activation thresholds, named incident leadership and alternates, pre-authorized containment decisions, authority contacts, and decision records. The messaging interface should use approved sender identities, least privilege, business-justified campaign and volume constraints, and rapid auditable restriction. Monitoring must route material outbound anomalies to personnel empowered to act. Exercises should test the complete sequence from triage and evidence preservation through parallel containment, reporting, restoration, and post-incident review.

Case 4 — Jinan mini-program operator: leaked stored data and missing governance controls

Factual narrative

In June 2026, Jinan public-security authorities received a departmental lead that backend-stored data from a WeChat mini-program operated by a local technology company had leaked. The company was both the construction and operating unit and used the mini-program for data processing. Investigators found that it had not established relevant security-management systems, organized data-security education and training, or adopted corresponding technical and other necessary measures. Authorities imposed an administrative penalty. The public account does not identify the company, data categories or volume, affected population, exposure period, leak route, architecture, response actions, exact legal basis, or penalty amount.

Analysis

Proximate control failure. Backend-stored data leaked in an environment that lacked the disclosed governance, training, and safeguard layers. The summary does not support attribution to an unpatched flaw, compromised credential, insecure interface, misconfiguration, insider, or service provider. A single technical root cause would therefore be speculative.

Root governance failure. The deeper problem was the absence of a demonstrated operating mechanism that allocated accountability, translated duties into procedures, trained personnel, selected safeguards according to risk, tested effectiveness, and closed deficiencies. Data Security Law Article 27 directly expresses this whole-process model. The Network Data Security Management Regulations further require management systems and necessary measures such as encryption, backup, access control, and security authentication, selected according to the actual risk.

Consequence pathway. The confirmed consequences were a stored-data leak and administrative enforcement. Further harm depends on undisclosed content, sensitivity, scale, recipients, and duration. Fraud, identity-related misuse, commercial injury, or loss of trust are possible pathways only if the leaked data and subsequent use supported them; the source does not permit ranking or quantification.

Regulatory and technical significance. The case demonstrates that a lightweight mini-program front end does not reduce responsibility for the processing environment behind it. Classification and grading should connect the harm from leakage or unlawful use to proportionate control design. GB/T 43697-2024 is a current recommended reference for that design, not evidence that a mandatory standards clause was breached.

Corrective priorities. The company should first preserve evidence and determine affected datasets, scope, exposure period, recipients, and continuing risk. It should then assign management ownership, map the full data lifecycle, classify data by realistic harm, and implement a validated baseline covering least privilege, strong privileged authentication, protected secrets, risk-appropriate encryption, protected and tested backups, reviewable logging, hardened configuration, controlled change, and timely remediation. Training should be role-specific, and all official findings should be tracked to evidence-based closure.

Case 5 — Qingdao platform operator: compromise enabled telecommunications fraud

Factual narrative

In April 2026, Qingdao public-security authorities found that a platform operated by a local technology company had been illegally controlled and used to place fraudulent calls. The investigation identified three deficiencies: the system lacked protective equipment such as firewalls and intrusion detection, required network logs had not been retained, and an administrator account had a vulnerability. Authorities stated that wrongdoers exploited these conditions, turning the platform into a telecommunications-fraud tool. The company received an administrative penalty. The publication does not identify the platform’s function, architecture, attack sequence, data impact, duration, call volume, victims, loss, exact legal basis, or penalty amount.

Analysis

Proximate control failure. Protective boundary and detection capabilities were absent, an administrator-account weakness impaired privileged-access assurance, and required records were not retained. The authority links these combined deficiencies to illegal control of the platform, but the summary does not establish their exploitation order or prove that any one condition was independently sufficient.

Root governance failure. Multiple basic deficiencies in one operating environment indicate that security ownership and assurance were ineffective. A functioning programme should maintain a risk-appropriate baseline, govern privileged identities, verify telemetry and record retention, and test controls after material change. The publication does not reveal the company’s staffing, budget, policies, service-provider arrangements, or classified-protection level.

Consequence pathway. The verified consequence was conversion of the platform into infrastructure for telecommunications fraud. This is a public-harm and system-integrity pathway, not merely an availability problem. Missing logs reasonably increase uncertainty in reconstruction, scoping, and verification of remediation, although the notice does not state that the investigation failed or that no other evidence existed. Victimization, financial loss, personal-information access, and carrier involvement are not disclosed.

Regulatory and technical significance. Cybersecurity Law Article 23 requires measures against attacks and intrusion, monitoring and recording of network operation and security events, and retention of relevant logs for at least six months. Article 27 requires incident planning and timely handling. GB/T 22239-2019 provides a recommended implementation baseline, but no case-specific grade or conformity finding is reported. The case shows why auditability is a governance control: without reliable records, an operator cannot readily prove what occurred, what was affected, or whether correction was effective.

Corrective priorities. The operator should contain unauthorized control through an approved incident process, preserve available evidence, and validate the platform before restoring exposure. It should maintain a complete asset and exposed-service inventory, deploy a risk-appropriate protective and detection architecture, and treat all administrator identities as high-impact assets through named ownership, least privilege, strong authentication, controlled provisioning, and privileged-activity review. Security-relevant logs should be collected, protected, monitored, and retained consistently with applicable legal requirements.

Case 6 — Qinzhou transportation group: deficient personal-information governance

Factual narrative

In July 2026, Qinzhou public-security authorities identified personal-information-protection noncompliance in a WeChat mini-program operated by a local transportation group. The group had not established internal management rules and operating procedures, had not applied security technical measures to stored user information, and had not regularly provided security education and training to personnel. Authorities imposed an administrative penalty. The record does not identify the organization, information types or volume, number of users, storage location, architecture, vendor, technical defect, breach, individual harm, statutory provision, or penalty amount.

Analysis

Proximate control failure. The mini-program’s processing environment lacked the three protection layers expressly identified in the notice: documented procedures, security technical measures for stored user information, and recurring staff education. This is a compound compliance and control failure, not a reported intrusion or confirmed leakage event.

Root governance failure. The combination indicates that the group had not converted personal-information responsibility into a repeatable, risk-based operating model. Roles, approved handling, technical protection, staff competence, and assurance evidence were not demonstrably connected. This inference does not establish intent, management awareness, outsourcing, budget constraints, or any particular missing technology.

Consequence pathway. The only confirmed consequence is administrative enforcement. As a risk matter, the deficiencies can permit inconsistent handling, access beyond business need, inadequate storage protection, delayed recognition of an incident, and poor evidence of lawful processing. No leak, alteration, loss, service interruption, or injury is reported.

Regulatory and technical significance. PIPL makes the personal-information processor accountable and requires risk-calibrated internal systems, classification, technical measures, rational permissions, recurring education and training, and an incident plan. The Cybersecurity Law adds complementary network-operation and user-information protections. The case illustrates preventive enforcement: an organization need not wait for a publicly established major breach before correcting an inadequate protection capability.

Corrective priorities. Management should establish an accountable owner and verify the mini-program’s information categories, purposes, storage locations, retention, roles, and participating providers. It should adopt usable procedures for authorization, least-necessary handling, user rights, retention and deletion, change, escalation, and supplier oversight where applicable. Risk-proportionate storage protection, access governance, logging, resilience, and response controls should be tested in practice. Training should be recurring, role-specific, and tied to evidence that personnel can apply the procedures.

Case 7 — Yibin tourism company: persistent cloud backdoor and bulk data export

Factual narrative

In July 2026, Yibin public-security authorities received a lead concerning abnormal data transmission from the ticketing system of a tourism-development company in Xingwen County. Investigators found an implanted backdoor management account on the ticketing system’s cloud server. The account enabled bulk data export and remained undiscovered for a long period. Further findings included incomplete network-security management, irregular management and inadequate protection of key shared terminals, absent relevant security-management systems, and failures to provide notice or protection when collecting, storing, and processing personal information. Authorities imposed an administrative penalty. The announcement does not identify the company, access vector, duration, cloud design, exported categories or volume, recipients, affected population, statutory provision, or penalty amount.

Analysis

Proximate control failure. Sustained unauthorized privileged access enabled bulk data export without timely detection. The public record establishes the backdoor management account, export, and prolonged nondetection, but it does not identify credential theft, a cloud misconfiguration, an application exploit, or another initial-access mechanism.

Root governance failure. The official findings indicate a fragmented control environment across privileged accounts, shared terminals, security management, personal-information notice, and safeguards. As an analytical inference, this fragmentation weakened attribution, anomalous-transfer detection, evidence, escalation, and response. The publication does not identify an individual insider, cloud provider, supplier, or precise compromise path.

Consequence pathway. Confirmed consequences are unauthorized bulk export, long-term nondetection, regulatory investigation, and an administrative penalty. Potential pathways include unlawful acquisition or reuse of exported data and impairment of individual rights if the exported material contained personal information. The notice does not expressly state that the exported material included personal information, sensitive personal information, payment data, or important data; nor does it report service interruption, individual notification, cross-border transfer, or downstream misuse.

Regulatory and technical significance. The case brings network operation, data security, and personal-information governance into one system. Cybersecurity Law duties concerning intrusion defense and monitoring, Data Security Law lifecycle obligations, PIPL notice and safeguard requirements, and the Network Data Security Management Regulations’ access-control and authentication model all bear on the disclosed failures. GB/T 22239-2019 can inform implementation but does not establish the ticketing system’s protection grade.

Corrective priorities. The company should contain unauthorized administration through an approved response process, preserve evidence, establish an authoritative account inventory, and determine the verified export scope. Privileged and service accounts should have named owners, justified permissions, controlled provisioning and removal, periodic review, and attributable records. Shared-terminal activity should be attributable to individuals. The company should inventory and classify ticketing-data flows, monitor privileged changes and anomalous transfers, repair notice and retention governance, train personnel, and obtain assurance over cloud and third-party responsibility boundaries where they actually exist.

Case 8 — Kunming individual: automated exploitation of vulnerable servers

Factual narrative

In April 2026, Xishan public-security authorities in Kunming received a report that a privately built server of an unnamed brand was experiencing severe network congestion and could not be accessed normally. Investigators traced the attacking IP address to Liu’s home broadband. The official account states that, after learning in early February 2026 that the relevant server brand had a high-risk vulnerability, Liu obtained server IP addresses in batches, wrote automated attack scripts, and unlawfully obtained information from other persons’ devices. Authorities imposed an administrative penalty on Liu. The publication does not disclose the server brand, vulnerability, number of systems, information type or volume, exploit path, data disposition, damage, exact legal provision, or sanction amount.

Analysis

Proximate control failure. The immediate failure was violation of the authorization boundary: vulnerability knowledge was converted into batch target acquisition and automated interaction with third-party systems. The reported availability symptom was severe congestion and loss of normal access at the reporting person’s server. The summary does not establish the full technical causal chain, persistence, traffic volume, or method of obtaining information.

Root governance failure. The actor did not keep vulnerability discovery within responsible reporting and remediation channels. Automation and batch acquisition increased potential scale, although the number of systems reached remains unknown. No employer, school, research institution, internet service provider, server owner, or vendor is identified as a governance cause.

Consequence pathway. Confirmed outcomes are congestion and access failure at one reported server, unlawful acquisition of information from other devices as stated by the authority, and an administrative penalty. Potential consequences include multiplied service disruption, response cost, and broader confidentiality risk, but the case does not establish data leakage, identity theft, financial loss, or a specific number of affected devices.

Regulatory and technical significance. Cybersecurity Law Article 29 prohibits illegal intrusion, interference with normal network functions, theft of network data, and provision of specialized harmful programs or tools. The Network Product Security Vulnerability Management Provisions prohibit using product vulnerabilities to endanger cybersecurity, encourage reporting to providers, require provider and operator remediation, and restrict harmful disclosure and tools. These are relevant principles, not a claim that the public-security decision cited a particular article. The case distinguishes responsible vulnerability stewardship from unauthorized exploitation.

Corrective priorities. Unauthorized interaction with third-party systems should cease, relevant evidence should be preserved, and vulnerability information should be directed to the provider or an authorized public reporting channel. Product providers and operators should maintain monitored intake, verification, impact assessment, time-bounded remediation, user guidance, and validation. Operators should reduce unnecessary external exposure, inventory supported assets, preserve relevant records, monitor abnormal access and availability, and rehearse containment and recovery. Sponsored security research should use written authorization, explicit scope, and a prohibition on live third-party exploitation.

Case 9 — Gansu amusement park: unnecessary facial-recognition processing

Factual narrative

In July 2026, Gansu public-security authorities found during a targeted personal-information-protection inspection that an amusement park’s smart lockers and entry gates used facial recognition as the sole authentication method and offered no alternative route. Investigators found that the park had not informed customers when collecting face information, lacked a specific purpose and sufficient necessity for collection, and had not implemented security technical measures. Authorities imposed an administrative penalty and supervised destruction of facial information retained without authorization. The publication does not identify the operator, affected population, data representation or volume, architecture, vendor, breach, exact statutory basis, or penalty amount.

Analysis

Proximate control failure. The product design compelled facial recognition for routine access and storage functions. It combined three disclosed deficiencies—no notice, no specific purpose and sufficient necessity, and no security technical measures—with the absence of a non-facial alternative.

Root governance failure. The pattern indicates an ineffective privacy-by-design approval gate for sensitive biometric processing. A competent gate would require a defined purpose, comparison with less intrusive methods, minimization, clear notice, lawful-processing design, impact assessment, retention, and evidence of safeguards before deployment. The official summary does not say whether a formal policy, impact assessment, consent mechanism, or vendor review existed, so the inference should not be extended beyond the observed outcome.

Consequence pathway. Confirmed consequences were administrative enforcement and supervised destruction of improperly retained face information. PIPL classifies biometric information as sensitive personal information because leakage or illegal use can readily harm dignity or personal and property safety. Unnecessary collection enlarges the sensitive-data footprint, while a sole biometric route constrains individual choice and may impede users who decline it. No breach, misuse, financial loss, discrimination, or physical-security incident is reported.

Regulatory and technical significance. PIPL requires a specific purpose, sufficient necessity, strict protection for sensitive personal information, advance notice, risk-calibrated safeguards, compliance audit, and prior impact assessment for sensitive processing. The Facial Recognition Technology Application Security Management Measures, effective from 1 June 2025, require purpose and necessity, detailed notice, shortest-necessary retention, a reasonable and convenient non-facial alternative where one can meet the same purpose, and system safeguards including encryption, audit, access control, authorization management, and intrusion detection and defense. The mapping is direct, but the enforcement decision’s actual cited provisions remain undisclosed.

Corrective priorities. The park should stop compulsory facial collection for locker and entry workflows and provide an equivalent, accessible non-facial method. Any continuing facial use should undergo documented necessity and less-intrusive-alternative analysis, prominent notice, a valid processing basis, shortest-necessary retention, and a personal-information protection impact assessment. The operator should complete a verified deletion programme across identified storage locations and apply risk-proportionate encryption, access control, authorization, audit, monitoring, secure configuration, training, and incident response.

Case 10 — Ningxia technology company: sensitive system data exposed through a public code repository

Factual narrative

In July 2026, Ningxia public-security authorities found that a user had uploaded sensitive data in complete form to a public repository on a global open-source code-hosting platform. The investigation determined that, in April 2025, Zhang—an employee of a Ningxia technology company responsible for operations and maintenance of a system—privately uploaded the system’s sensitive information to a personal repository to facilitate internal project collaboration. The upload exposed the maintained system’s network architecture, security-protection design, and internal personnel information. Authorities imposed administrative penalties on both the company and Zhang. The announcement does not identify the platform, repository, company, system owner, data volume, access history, legal classification, downstream use, statutory provision, or penalty amount.

Analysis

Proximate control failure. The immediate failure was public disclosure of restricted operational material through a personal repository. No external intrusion or software exploitation was necessary: the employee crossed the confidentiality boundary by placing complete sensitive system information in a public space. The source does not establish whether outsiders downloaded, copied, or used the material.

Root governance failure. The deeper issue was ineffective governance of the collaboration path used by operations personnel. The organization did not produce an effective outcome in which sensitive material could be shared only through approved, auditable channels matched to its classification. Classification rules, managed identities and repositories, external-release approval, monitoring, and role-based training are corrective control objectives; the summary does not individually find that each was absent.

Consequence pathway. Confirmed consequences are exposure of network architecture, security-protection information, and internal personnel information, followed by penalties for the company and employee. Such disclosure can reduce uncertainty for future targeted reconnaissance and can create privacy, impersonation, contractual-confidentiality, and reputational risks. Those risks are not proof of subsequent compromise, personal-information misuse, economic loss, or criminal proceedings.

Regulatory and technical significance. The Data Security Law expressly includes disclosure within data processing and requires lifecycle management, training, safeguards, risk monitoring, and incident handling. The Network Data Security Management Regulations require network-data processors to establish management systems and apply measures such as access control and security authentication, while maintaining an incident plan. GB/T 43697-2024 can inform internal classification and handling rules. The official description “sensitive data” does not by itself prove that the information was legally designated important data, core data, a state secret, or a cross-border transfer.

Corrective priorities. The company should restrict public access through an authorized process, preserve repository and response evidence, identify all uploaded content and its actual exposure, and assess applicable reporting or notification duties from verified facts. It should classify architecture, security-design, and personnel material; define content that may never be publicly released; and require organization-controlled repositories, managed accounts, least privilege, project separation, and exception approval. Classification-aware publication review, outbound-content controls, audit records, external-exposure monitoring, scenario-based training, and a rehearsed repository-disclosure response should make convenient but unsafe collaboration difficult and detectable.

Closing assessment

The ten summaries support a coherent enforcement message. Security obligations attach to how organizations operate systems and process data over time. Vulnerability remediation without access governance is incomplete. A written incident plan without activation authority is ineffective. Logging without retention and review cannot support accountability. Personal-information notices cannot justify collection that lacks necessity. Training cannot substitute for technical controls, and technical controls cannot substitute for governance that assigns ownership, purpose, and decision rights.

For regulated operators, the most durable response is therefore not a case-by-case patch list but an evidence-producing control system. Every material asset, data flow, privileged capability, processing purpose, external disclosure path, and incident decision should have an accountable owner and a verifiable control outcome. That approach aligns technical protection with the lifecycle, response, and accountability principles expressed across China’s cybersecurity, data-security, and personal-information framework, while respecting the substantial factual uncertainty that remains in these anonymized public summaries.

References

[1] 公安机关深入开展‘护网—2026’专项工作 全力强化网络空间安全保护和综合治理

[2] 中华人民共和国网络安全法

[3] 中华人民共和国数据安全法

[4] 中华人民共和国个人信息保护法

[5] 网络数据安全管理条例

[6] 国家网络安全事件报告管理办法

[7] 工业和信息化部 国家互联网信息办公室 公安部关于印发网络产品安全漏洞管理规定的通知

[8] 人脸识别技术应用安全管理办法

[9] GB/T 22239-2019 信息安全技术 网络安全等级保护基本要求

[10] GB/T 43697-2024 数据安全技术 数据分类分级规则

AI capabilities demonstrated elsewhere in China during 2026

China’s broader 2026 cybersecurity ecosystem nevertheless demonstrates how AI could support HuWang-type operations:

Operational function	Documented adjacent AI application	HuWang status
Detection and monitoring	Streaming analysis of network, endpoint, authentication, DNS, and web-security telemetry	Not publicly confirmed in HuWang
Alert triage	Alert deduplication, classification, prioritization, and false-positive reduction	Vendor claims only
Attack-chain reconstruction	Correlation across devices, data sources, and time periods	Tested by CNCERT, not HuWang
Vulnerability management	AI-assisted source-code analysis, vulnerability discovery, validation, and prioritization	Tested separately
Incident response	AI recommendations connected to predefined security-orchestration playbooks	Vendor cases; generally human-supervised
Exercise adjudication	Automated assessment of vulnerability reports and AI-supported scoring	Demonstrated in a separate university exercise
AI-system defense	Model guardrails and detection of malicious or unauthorized agent behavior	Separate national testing program
Red-team assistance	Exposure analysis, research triage, attack-path reasoning, and content drafting	Claimed in practitioner articles but unverified

The strongest official adjacent evidence is the 2026 CNCERT AI-enabled cybersecurity application test. Its eight scenarios included AI-driven cyber defense, intelligent vulnerability discovery, traffic-threat detection, alert-log denoising, large-model guardrails, and detection of malicious AI-agent actions. The program attracted 151 organizations and 251 teams, with 32 teams receiving favorable results. However, the program was separately organized and should not be presented as part of HuWang.

A Shandong University exercise provides a concrete—but institutionally separate—example of fuller integration. It reported a security-domain model supporting defenders, AI-assisted simulated attacks, automated vulnerability-report adjudication, and closed-loop remediation. The university stated that AI-assisted tools contributed to 60 percent of the vulnerabilities identified by student teams.

Analytical conclusion

The most defensible interpretation is that AI was materially relevant to the environment surrounding HuWang–2026 but is not publicly verified as an internal HuWang operational mechanism. Where AI-supported Chinese cyber-defense operations are documented, the emerging model is predominantly human-supervised decision support:

1. AI correlates telemetry and reduces alert volume.
2. Analysts validate AI-generated findings.
3. Automated actions remain constrained by predefined playbooks.
4. Human officials retain authority over consequential containment, remediation, enforcement, and disclosure decisions.
5. AI systems themselves become protected assets requiring access control, audit logs, behavioral monitoring, guardrails, and emergency-stop mechanisms.

For technical accuracy, the article should therefore state that AI became increasingly prominent in China’s wider cybersecurity testing, product, and operational ecosystem during 2026, rather than asserting that these capabilities were conclusively deployed within HuWang.

Artificial Intelligence in the Operational and Defense Mechanisms of HuWang–2026

Technical evidence assessment Research boundary: Publicly accessible material reviewed through 23 September 2026 Author: Manus AI

Bottom line

Publicly documented HuWang–2026 was a Ministry of Public Security (MPS)-associated nationwide network-, data-, and information-security special-work programme, not a publicly specified national red-team/blue-team exercise. Its documented mechanisms were information notification and warning, inspections, risk discovery, remediation, application compliance action, and administrative enforcement. The national MPS-attributed account reports more than 7,900 network- and data-security risk inspections, correction of 38,000 risks and vulnerabilities, 652 non-compliant applications exposed, and 38,000 administrative cases. It does not identify artificial intelligence (AI), large language models, AI agents, automated detection, a command platform, teams, rules, scoring, or formal exercise phases.

Accordingly, the only direct HuWang-context AI evidence is defensive threat context: Jiangsu police stated that criminals were maliciously using AI in cyberattacks and that their techniques were evolving. This is evidence that AI shaped the risk environment addressed by HuWang; it is not evidence that HuWang itself deployed AI. The national report’s reference to an automated attack script concerns an offender’s conduct, not a police automation capability.

The more specific answer is therefore two-layered. Inside the documented HuWang–2026 record, AI is not publicly shown as an operational or defense mechanism. Around HuWang, 2026 Chinese official tests, adjacent exercises, standards guidance, operator statements, and vendor cases show AI being evaluated or claimed for bounded functions: multi-source log correlation, attack-chain reconstruction, packet-traffic threat detection, alert denoising, vulnerability discovery and validation, model guardrails, detection of malicious agent actions, and supervised response workflows. Those sources establish capability development or deployment claims, but they cannot be converted into a factual assertion of HuWang–2026 use.

Concise answer: HuWang–2026’s public record documents conventional, human-accountable security governance and remediation. AI appears directly only as an adversarial threat category. AI-enabled detection, analysis, testing, and agent governance are strongly evidenced in adjacent 2026 Chinese activity and in vendor/participant claims, not as verified components of HuWang–2026 itself.

Scope, terminology, and evidentiary method

This report uses HuWang–2026 narrowly: the MPS-associated programme explicitly labelled “护网—2026” in the national report. This is necessary because “HuWang/HVV” is also used for local real-network exercises, institutional exercises, commercial preparation services, and practitioner commentary. Shanxi’s public report describes HuWang as inspection, rectification, and enforcement work, while Fujian’s separately named Mindun–2026 drill disclosed its own dates, 40 attack teams, nearly 500 participating entities, and 1,384 submitted result reports. The Fujian drill cannot establish the format of the national HuWang programme.

The report organizes evidence by an analytical operational lifecycle—baseline, monitoring, triage and response, assessment, and remediation—because no authoritative national HuWang–2026 source publishes such phases. The lifecycle headings are therefore a synthesis device, not a claim about the programme’s official sequence.

Label	Meaning in this report	Permitted conclusion	Prohibited conclusion
D — Documented 2026 HuWang evidence	Contemporary public authority material expressly describing HuWang–2026.	What MPS or local public-sector sources say HuWang did or observed.	Unstated AI deployment, formal exercise design, or red/blue structure.
V — Vendor or participant claim	Supplier case study, operator statement, conference account, community guide, or self-described practitioner article.	A supplier, participant, or commentator claimed or marketed a capability.	Independently audited efficacy or HuWang participation absent corroboration.
A — Adjacent-practice evidence	Official 2026 test, separately named exercise, or standards-practice guidance outside HuWang.	A capability was tested, governed, or demonstrated elsewhere.	That the capability was used or required in HuWang–2026.
I — Analytical inference	A bounded judgment drawn from D, V, and A evidence.	A plausible operating implication, stated as inference.	A factual attribution to HuWang or any unnamed participant.

Evidence-strength table

Evidence level	Principal sources	What the evidence establishes	Key boundary
High: D, national official account	MPS-attributed national report republished by Xinhua.	HuWang–2026 existed as national special work; its public functions were notification/warning, inspection, risk remediation, governance, and enforcement. It supplies the reported inspection, remediation, application, and case figures.	It is not an exercise plan and contains no statement that AI performed any programme function.
High: D, local government corroboration	Jiangsu, Shanxi, Ningxia, and MPS-content reproduction.	Local implementation included online and on-site inspection, risk notices, correction orders, application testing, enforcement, and source-governance controls. Jiangsu identifies malicious AI use as a threat.	These sources do not describe an AI-enabled HuWang defence stack, AI command cell, or national attack-and-defense drill.
High: A, official controlled evaluation	CAC/CNCERT announcement, technical specification, and results release.	China formally evaluated AI-enabled security functions in eight controlled scenarios; 151 organizations and 251 teams entered, and 32 teams received good results.	The programme is a separate AI-security application test. Controlled performance is not HuWang deployment or production assurance.
Moderate: A, official adjacent exercise and standards guidance	Shandong University exercise account and TC260 agent guide.	An adjacent exercise reported all-process AI enablement and AI-assisted vulnerability-report determination; TC260 specifies agent lifecycle controls.	Neither source is a national HuWang rule or after-action report.
Moderate to low: V, attributable supplier/operator cases	Operator releases and vendor cases on managed security, AI SOC, phishing analysis, and AI governance.	Organizations market or claim deployments, mechanisms, and selected operating results.	Metrics, customer identities, and causality are often unverified or selectively disclosed; none demonstrates HuWang–2026 use.
Low: V, HuWang-labelled practitioner commentary	Two CSDN articles and a Tencent Cloud community guide.	Public discourse claims AI-assisted red-team analysis, automation, and preparation in the HVV ecosystem.	No named organizer, participant, artifacts, raw data, methodology, or independent corroboration supports attribution to HuWang–2026.
Inference only: I	Synthesis of the above sources.	A defensible model is human-supervised AI decision support with bounded authority, auditability, and fallback.	This is not a reported HuWang operating doctrine.

What is directly documented for HuWang–2026

The national account describes HuWang–2026 as a continuing public-security programme for network, data, and information security. It uses the national network-and-information-security information-notification mechanism to disseminate warnings and protective guidance; conducts inspections and risk rectification; concentrates on application personal-information and data-protection failures; and brings administrative cases when protection duties are not met. The disclosed numbers demonstrate the programme’s scale, but not competitive scoring, target lists, attacker tasking, automated security operations, or a public red-versus-blue design.

Local reports sharpen the operating picture without altering that conclusion. Shanxi records online inspections, field verification, risk-notice letters, correction orders, enforcement, and application/miniprogram testing. A HuWang-era MPS-content enforcement case describes asset and port review, vulnerability scanning, risk assessment, remediation, and verification after a school server was found with high-risk ports, vulnerabilities, weak passwords, and inadequate logging. The account does not say these tasks were AI-driven or automated.

The public record offers one narrow AI statement. In its HuWang–2026 context, Jiangsu police assessed that criminals maliciously use AI technology in network attacks and that criminal techniques are evolving. This records an AI-shaped threat environment, not a HuWang AI tool, agent, model, or team. Similarly, the national article’s automated-script reference belongs to a case about unlawful data acquisition by an offender; it cannot be recast as official attack automation.

Mechanism table: phase, function, and evidence boundary

The following table answers the operational question while preserving source distinctions. “Not documented” means not documented in the reviewed authoritative public HuWang corpus; it is not proof that a restricted or unpublished capability did not exist.

Analytical phase and operational function	D — Direct HuWang–2026 record	V — Vendor/participant claim	A — Adjacent-practice evidence	I — Bounded assessment
1. Baseline and exposure governance	Inspections, risk discovery, remediation, and source-governance controls are documented; no AI attribution appears.	A provider markets AI-enabled exercise baselining, exposure assessment, hardening, and monitoring, without a named HuWang customer.	CNCERT tested AI-agent target understanding, program analysis, vulnerability validation, and assessment with reproducible results.	AI could prioritize evidence for analysts, but public material does not show it creating HuWang’s asset baseline.
2. Warning, telemetry, and detection	Notification/early-warning mechanisms are documented; AI monitoring is not.	China Telecom Chongqing claims asset discovery, full-traffic monitoring, AI assessment, and vulnerability scanning in a managed-security platform.	CNCERT tested streaming multi-source-log analysis, attack-chain reconstruction, packet-traffic threat detection, and identification of true alerts.	The strongest adjacent pattern is telemetry plus AI correlation and denoising, not autonomous HuWang detection.
3. Triage, command, and containment	Warnings, risk notices, correction orders, and enforcement are documented; no AI command system is identified.	An anonymous securities case says AI ranked and filtered alerts while SOAR executed playbook-bounded actions; high-risk conclusions and production-impacting actions retained human review or approval.	TC260 guidance calls for least privilege, logging, restricted exposure, and confirmation or blocking of high-risk agent actions.	The evidence favors supervised decision support and bounded automation, with human accountability for consequential action.
4. Assessment and attack-side activity	Jiangsu identifies malicious attacker AI use; no named HuWang team or AI-enabled exercise operation is reported.	CSDN authors claim AI-assisted exposure analysis, triage, reasoning, content drafting, and automation in HuWang/HVV work, but provide no verifiable exercise record.	CNCERT evaluated agent vulnerability work in a controlled setting; a BCS forum recorded adjacent presentations on AI-assisted security testing and agent safety.	AI assistance for high-volume research is plausible, but autonomous or named HuWang red-team activity is unproven.
5. Evidence capture, scoring, and reporting	No national HuWang AI scoring, report generation, or talent assessment is publicly documented.	Suppliers market lifecycle reporting and operational analysis, but do not provide a HuWang–2026 after-action or scoring record.	Shandong University reported large-model-assisted vulnerability-report determination; CNCERT used accuracy and missed-detection measures in its separate test.	AI-assisted evaluation is demonstrably being explored elsewhere; attributing it to HuWang would be an overreach.
6. Remediation and after-action closure	HuWang reports correction of 38,000 risks and vulnerabilities; it does not state AI prioritized or applied fixes.	Vendor services claim before/during/after monitoring, review, and remediation, without independently verified HuWang results.	Shandong University reported a remediation ledger, assignment by severity, and closure; Huaihua’s exercise used risk referral and deadline remediation.	AI may organize remediation evidence and prioritization, but no source documents autonomous HuWang remediation.
Cross-cutting: protection of AI systems and agents	No HuWang–2026 source publishes an AI-asset inventory, model guardrail, or agent-control requirement.	Operators claim model/agent governance, input/output inspection, and large-scale risk checks; these remain operator self-reports.	Official tests included large-model guardrails and detection of privilege escalation, data exfiltration, and destructive agent behavior; TC260 provides lifecycle controls.	AI systems should be treated as both security tools and protected assets, but this is an analytical extension—not a verified HuWang mandate.

Phase-by-phase analysis

Phase 1 — Preparation, asset visibility, and risk baselining

D — Documented HuWang practice. The programme’s preparation-like activity is conventional security governance: inspections, exposure discovery, remediation, and verification. The national report records more than 7,900 network/data-security risk inspections and correction of 38,000 risks and vulnerabilities. The Wuhan case presents asset/port review, scanning, assessment, remediation, and verification as expected controls after weaknesses were discovered, but identifies no AI system in that chain. Thus, the evidence supports risk baselining without a documented AI mechanism.

A — Adjacent practice. CNCERT’s separate 2026 test provides precise evidence that Chinese evaluators considered AI-supported vulnerability work ready for controlled assessment. Its vulnerability scenario required agents to perform target understanding, program analysis, vulnerability validation, and assessment, and required outputs to be reproducible for evaluators. The result announcement confirms that the national test was completed and publicly lists teams with good results, but does not publish a HuWang connection or validate real-network production performance.

V — Vendor and participant claims. China Telecom Chongqing describes its “Yiwei” managed-security platform as combining asset discovery, full-traffic threat monitoring, AI assessment, and vulnerability scanning. This is an operator product/operations statement rather than a customer-validated HuWang record. A Tencent Cloud community post markets a staged HVV preparation model and automated exposure identification, but it is preparation guidance rather than an organizer’s HuWang plan and does not establish that the automation is generative AI.

I — Assessment. The supported inference is that AI can be a triage and prioritization layer over conventional baselining. It may help structure high-volume asset, vulnerability, and remediation evidence for analyst review. It is not justified to say that it built the HuWang–2026 asset inventory or autonomously drove risk reduction.

Phase 2 — Warning, telemetry, detection, and correlation

D — Documented HuWang practice. HuWang’s national public record includes the network-and-information-security notification mechanism, warnings, and targeted protective guidance. Shanxi documents online inspection and on-site verification. These are operational defensive mechanisms, but the sources do not identify AI analytics, a security operations center (SOC) copilot, continuous AI monitoring, or an AI-generated warning process.

A — Adjacent practice. The CNCERT technical specification is the strongest source for the mechanics of AI-enabled detection in the 2026 Chinese environment. One scenario assessed real-time analysis of streamed WAF, web, DNS, host-process, and authentication logs, including cross-device and cross-time-window correlation to reconstruct an attack chain. Other scenarios assessed threat-stage recognition from packet capture and identification of true alerts from network-threat and endpoint logs. The evaluation used accuracy and missed-detection measures. These details show what government-backed evaluators measured; they do not show that an AI detector was installed during HuWang–2026.

V — Vendor and participant claims. Qianxin reports that it ranked first in alert-log denoising and describes deduplication, correlation, classification, and multi-agent cross-validation. The official results release independently confirms the test and names successful teams, while the company’s ranking detail, architecture, and quantitative benefits remain its own claims. Sangfor similarly claims an award in the AI-driven attack-defense scenario and describes telemetry, relationship graphs, investigation, and attack-path governance; its architecture and outcome claims are vendor statements.

I — Assessment. The most evidence-supported adjacent defense pattern is: collect heterogeneous telemetry; use AI to correlate, reduce noise, and identify plausible attack chains; route prioritized findings to analysts; then act through constrained response controls. This is a description of an adjacent capability trajectory, not a claim that HuWang used an AI SOC.

Phase 3 — Triage, incident coordination, and response authority

D — Documented HuWang practice. The HuWang sources provide a human-governance model. They describe notifications, risk letters, correction orders, enforcement, and consequences for failures to fulfil protection duties. The available sources do not disclose a national AI command-and-control layer, automated containment authority, AI task routing, or 24/7 AI operations center.

V — Vendor/participant claim. A Qianxin-published, anonymous securities-company case is unusually specific about human–machine boundaries. It says AISOC continuously parses NDR and EDR alerts, ranks risk, and passes actions to SOAR playbooks that coordinate firewall, endpoint, and web-application-firewall controls. The account states that analysts review high-risk conclusions and approve actions affecting production systems, and that the model does not directly generate low-level commands. Because the customer is anonymous and the case is vendor-published, this is credible design evidence but not independent validation or HuWang evidence.

A BCS conference account records similar claims and cautions: agents can assist with repetitive queries, correlation, investigation, and hunting, but speakers highlighted hallucination, prompt injection, contextual manipulation, excessive privileges, audit gaps, and the need for result verification. This supports the proposition that vendor-side discourse recognizes governance constraints; it does not establish the safety of any deployment.

A — Adjacent practice. TC260’s agent-deployment guide sets out a strong control model for systems that use agents: prior assessment, maintained and trusted components, isolation, official interfaces, least privilege, restricted network exposure, logs for file, command, network, and skill activity, and confirmation or blocking for defined high-risk actions. The guide is not an exercise rule, but it is authoritative adjacent guidance on keeping agent behavior bounded.

I — Assessment. For high-impact environments, the evidence favors constrained automation rather than unconstrained autonomous response. AI can support triage, evidence organization, and recommendations; accountable humans should retain authority over consequential containment and recovery. This is a policy inference from the cited adjacent case and guidance, not a claim about a HuWang command policy.

Phase 4 — Assessment activity, adversarial AI, and red-team claims

D — Documented HuWang context. The direct AI statement is defensive threat intelligence: Jiangsu police warned that criminals use AI maliciously in network attacks. That supports the conclusion that AI was a recognized threat factor. It does not identify a named 2026 HuWang attack team, authorized AI assessment workflow, AI-generated content process, or autonomous agentic operation.

V — HuWang-labelled claims. A self-described CSDN practitioner article claims that 2026 HuWang red teams used AI for exposure analysis, vulnerability-log triage, path reasoning, social-engineering content drafting, and repetitive-task automation, while retaining human review. A second CSDN article makes broader claims about agentic HVV activity but lacks a verifiable organizer, participants, data, methods, or original documentation; its apparent CVE identifier error further weakens its reliability. These items are properly treated as low-confidence practitioner narratives, not as after-action reports.

A — Adjacent practice. CNCERT’s controlled test establishes that AI-agent vulnerability discovery and validation were evaluated in a defined, scored setting. A BCS 2026 forum also publicly recorded presentations on AI-enabled attack teams, autonomous testing, AI code-vulnerability research, and agent security. The event validates that such work was being discussed and presented in China; it does not independently validate every presenter claim or attach it to HuWang.

I — Assessment. It is plausible that authorized assessors could use AI as a human-supervised copilot for research organization, evidence correlation, and other high-volume analytical tasks. The available evidence does not support characterizing HuWang red teams as uniformly AI-equipped, autonomous, or engaged in a specified AI-driven operation. This report therefore avoids operational attack detail and treats AI-enabled offensive claims as unverified unless corroborated by an organizer or named participant record.

Phase 5 — Evidence capture, evaluation, scoring, and reporting

D — Documented HuWang practice. No reviewed national HuWang source documents AI-generated reports, AI scoring, automated talent assessment, or AI adjudication. The direct programme record instead concerns inspection, remediation, and enforcement outcomes. It would therefore be inaccurate to infer a national AI evaluation platform from the use of “HuWang” alone.

A — Adjacent practice. CNCERT’s test shows a more rigorous model for evaluating the AI component itself: its scenarios use defined inputs and score functions such as identification accuracy, missed-detection rate, attack-chain reconstruction quality, and reproducibility of vulnerability descriptions. The official results report says 151 organizations and 251 teams participated, with 32 teams obtaining good results across the eight scenarios. These outcomes evidence a completed national capability evaluation, not a HuWang scorecard.

Shandong University reported a distinct June 2026 exercise with end-to-end AI enablement, a security-domain model for defense, AI-assisted testing, real-time detection/analysis/response, and large-model-assisted determination of vulnerability reports. It also reported a remediation ledger and closure process. This is the clearest official adjacent example of AI participating in exercise evaluation, yet it remains a university exercise rather than a national HuWang record.

Regional exercises reinforce the baseline human model. Huaihua reported digital result uploads, full-process human monitoring and evaluation, a summary and result determination, and referral of findings for deadline remediation. Fujian’s Mindun–2026 reported result submissions and rankings without claiming AI scoring or report generation.

I — Assessment. If an exercise integrates AI, assurance should separately evaluate (1) the protected organization’s security outcome and (2) the AI assistant’s quality, traceability, misses, reviewer overrides, and fallback behavior. That is an inference from CNCERT’s metrics and adjacent exercise practice; it is not a HuWang requirement.

Phase 6 — Remediation, enforcement, and after-action closure

D — Documented HuWang practice. Remediation is the most explicit outcome in the national HuWang account: it reports correction of 38,000 risks and vulnerabilities and extensive administrative case handling for failures of network, data, and personal-information protection duties. Shanxi reports correction orders and risk-notice letters, while the Wuhan case describes remediation and verification after assessed weaknesses. The sources do not state that AI set priorities, generated fixes, or independently verified closure.

A — Adjacent practice. Shandong University reported root-cause review, a remediation ledger, severity-based assignment, and closure of items one by one. Huaihua’s official account describes risk referral and supervised time-limited remediation. Together, these sources establish a conventional closed-loop pattern outside HuWang: discover, document, assign, correct, verify, and summarize.

V — Vendor claims. Supplier material markets a full lifecycle spanning assessment before an exercise, monitoring and response during it, and attack-path review, patch management, policy improvement, and reporting afterward. It gives no named HuWang–2026 customer, accepted deliverable, or independently measured result.

I — Assessment. AI may be useful for grouping duplicate findings, linking evidence, suggesting ownership, and monitoring closure evidence. Nothing in the reviewed material establishes AI-autonomous remediation in HuWang, and the human review and control boundaries documented elsewhere argue against such an attribution.

Cross-cutting defense domain: securing the AI systems themselves

The question is not only whether AI supports security operations; it is also whether models and agents become systems that security operations must defend. No public HuWang–2026 source publishes a uniform AI-asset inventory or agent-security checklist. Yet adjacent official evidence shows that Chinese evaluators treated AI-specific defense as a distinct domain.

CNCERT’s application-test specification includes large-model guardrails and detection of malicious agent behavior from application, host, and packet-capture logs. The malicious-agent scenario covers unauthorized privilege acquisition or escalation, sensitive-data theft or exfiltration, and destructive actions. A separate CNCERT large-model security public test includes open models, model applications, agent applications, model/agent vulnerabilities, cryptographic risks, traditional vulnerabilities, remediation, and retesting.

TC260 guidance provides the most concrete adjacent governance framework. It addresses the need and risk assessment of agents; software provenance and maintenance; isolation; trusted interfaces; access control; least privilege; logging; external exposure; high-risk action confirmation or blocking; testing of skills; update management; and secure decommissioning. These are controls for organizations deploying agents, not published HuWang–2026 rules.

Operator claims demonstrate market movement but retain evidentiary limits. China Telecom says its AI security platform connects more than 9,300 government and enterprise customers and provides model-call governance, agent guardrails, and real-time input/output inspection. An industry report of China Mobile’s exhibition claims agent-asset inspection, closed-loop remediation, and risk checks of 280 models and 699 agents. Such scale and effectiveness statements are self-reported or media-reported operator claims; they cannot establish a HuWang deployment.

Analytical implication. Where an organization deploys models, retrieval/knowledge systems, agents, APIs, or tool-using workflows, an exercise can reasonably add AI-system assurance to conventional cyber assurance. The supported policy components are an inventory of AI assets and identities, least-privileged access, protected telemetry, auditable tool use, tested guardrails, high-risk-action controls, and verified rollback or stop processes. This conclusion synthesizes official adjacent tests and guidance; it is not an assertion that HuWang–2026 imposed those controls.

What the evidence supports—and does not support

Supported findings

The strongest supported conclusion is that HuWang–2026 publicly operated through human-accountable cyber governance: warnings, inspections, risk notification, rectification, compliance checks, and administrative enforcement. In direct HuWang evidence, AI is a threat descriptor associated with malicious activity, not an identified defensive or operational capability.

A separate, policy-backed 2026 Chinese ecosystem was evaluating AI for security work. The CNCERT test demonstrates interest in measurable functions: log correlation, attack-chain reconstruction, flow analysis, true-alert identification, vulnerability discovery and validation, model guardrails, and malicious-agent detection. An adjacent university exercise demonstrates that a smaller, explicitly identified exercise could report all-process AI enablement and AI-assisted report assessment.

Vendor and operator material makes a narrower, qualified contribution. It supports that AI-assisted SOC triage, playbook-bounded response, phishing analysis, asset visibility, and model/agent governance were being sold, demonstrated, or claimed in normal operations. The most detailed anonymous SOC case explicitly preserves analyst review and approval for high-impact actions. This is evidence of a supervised-defense design pattern, not proof of a HuWang technology stack.

Unsupported claims

The reviewed public record does not support the following statements: that HuWang–2026 was a single publicly specified national red-team/blue-team exercise; that it had a public AI command center, AI agents, AI SOC, AI scoring system, AI-generated reports, or autonomous remediation; that a named HuWang team used AI for a defined operation; or that a vendor product or a separate 2026 drill participated in HuWang–2026. The authoritative sources reviewed also did not corroborate a nationally defined July–August exercise window or a tenth-anniversary red/blue exercise format.

It is similarly unsupported to treat commercial preparation templates, conference presentations, unverified social-media articles, national AI-security tests, or regional exercises as substitute evidence for an MPS HuWang capability.

Limitations

Public-source boundary. The negative findings in this report mean “not found in the authoritative, publicly accessible material reviewed through 23 September 2026.” They do not prove that restricted, unpublished, operational-security-protected, or non-public HuWang material does not exist. CNCERT’s own test announcement restricted unapproved disclosure and retention of test data, illustrating why public visibility can be incomplete.

Terminological ambiguity. “HuWang/HVV” spans MPS special work, regional real-network drills, institutional exercises, and commercial marketing. The report keeps titles, organizers, and jurisdictions separate because Shanxi’s HuWang enforcement report and Fujian’s separately named Mindun exercise describe different categories of activity; neither should be used to invent an undisclosed national HuWang red/blue format.

Controlled tests are not production assurance. CNCERT’s programme demonstrates performance under defined scenarios and metrics. It does not establish long-duration reliability, resilience under changing operational conditions, safety of autonomous action, or customer-network outcomes.

Vendor-claim limits. Supplier and operator material may accurately describe products or client work, but disclosed metrics may be selective, methods may be unavailable, and customers may be anonymous. The securities SOC example cannot independently establish customer identity, duration, or outcome measurement; the China Telecom and China Mobile scale claims are likewise self-reported.

Safety boundary. This report deliberately omits exploit steps, payload construction, bypass methods, target selection, and procedural attack instructions. Its treatment of assessment activity is limited to evidence classification and defensive policy implications.

Conclusion

The best-supported characterization is precise rather than expansive. HuWang–2026’s public operational architecture was notification, inspection, rectification, and enforcement. AI was directly visible only as an evolving malicious-use threat. The public record does not substantiate an assertion that AI was integrated into HuWang’s command, defense operations, red-team activity, scoring, reporting, or remediation.

At the same time, it would be misleading to conclude that AI had no relevance to the 2026 Chinese cyber-exercise environment. Adjacent official tests and exercises show a concrete capability agenda: AI-supported telemetry analysis, attack-chain correlation, vulnerability validation, alert reduction, guardrails, malicious-agent detection, and AI-assisted evaluation. Vendor and operator accounts add a plausible operating architecture centered on human-supervised analysis and policy-bounded response, but they remain claims unless independently corroborated.

Therefore, the defensible bottom line is: AI was materially relevant to the surrounding threat, evaluation, and security-operations ecosystem in 2026, but public evidence does not verify that it was an integrated operational or defense mechanism of the MPS HuWang–2026 programme itself.

References

[1] 公安机关深入开展“护网—2026”专项工作 全力强化网络空间安全保护和综合治理

[2] 江苏警方曝光5起不履行数据安全保护义务案例

[3] 山西省公安机关“净网2026”“护网2026”专项行动工作成效发布

[4] 护网—2026｜高危端口大开、数据面临泄露风险 网警依法查处一未依法履行网络安全保护义务案

[5] 2026年人工智能技术赋能网络安全应用测试公告

[6] 测试场景说明

[7] 2026年人工智能技术赋能网络安全应用测试结果发布

[8] 数智化支撑研究院开展网络安全攻防演练和应急演练

[9] TC260-PG-20266A 网络安全标准实践指南——智能体部署使用安全指引

[10] 强化实战能力 筑牢安全屏障 ‘网安怀化·2026’网络安全实网攻防演习正式启动

[11] 福建省委网信办成功举办“闽盾-2026”网络安全攻防演练

[12] 中国电信重庆公司6项成果亮相重庆市‘五小’创新晒

[13] “AI+SOAR”双轮驱动｜某头部证券公司智能安全运营转型实践

[14] AI智能体赋能安全新范式：企业安全防护与运营一体化论坛成功举办

[15] “AI哨兵”专治钓鱼邮件 ，为这家大健康制造企业征战全球市场扫雷

[16] 无安全不智能 无智能不安全——中国电信以全栈安全能力护航智能时代

[17] 中国移动智启网信安全新范式

[18] 2026 网安周｜奇安信在国家级AI赋能网络安全应用测试中获双第一

[19] 网安周双料第一 ，深信服AI原生护航智能时代！

[20] 护网2026红队AI实战渗透教程：全链路落地技巧与避坑方案

[21] 2026 护网行动 AI智能体攻防实战：漏洞检测、防御落地与避坑指南

[22] BCS 2026 | AI安全论坛在京举行：安全是打出来的、练出来的

[23] 2026 HVV 护网行动备战完全指南：90 天倒排时间表（含演练清单 ）

[24] 2026年人工智能大模型安全众测活动公告