Hong Kong Police Deploy AI to Aid INTERPOL; Autonomous AI Agent Launches Two-Week Telecom Intrusion — Daily AI and Cyber Risk Summary
In a nutshell: The Hong Kong Police used self-developed AI technology to support INTERPOL's "Operation Swift Strike 2.0", while researchers revealed that hackers have handed an entire intrusion process over to an autonomous AI agent; the world simultaneously faces the dual challenges of the industrialisation of AI fraud and the enterprise cyber insurance awareness gap.
Hong Kong Police Use AI Technology to Support INTERPOL's "Operation Swift Strike 2.0" (HK01, 2026-11-10): The police said Hong Kong's first-quarter technology crime amount grew by over 70% year-on-year, and in recent months local enterprises including Cathay Pacific, Hong Kong Airlines, YOHO, Broadway Electrical, and the Hong Kong Examinations and Assessment Authority have successively suffered data breaches, which the cyber security community has called "Black October". Superintendent Lam Cheuk-ho of the Cyber Security and Technology Crime Bureau noted that hackers are already using automated "agentic AI" to scan institutions' vulnerabilities around the clock and intrude immediately. The police's self-developed AI technology has been used in INTERPOL operations, with the new round of "Operation Swift Strike 2.0" launched in Hanoi, Vietnam, expanding participating jurisdictions to 24, aiming to proactively block malicious websites.
Autonomous AI Agent Independently Launched a Two-Week Telecom Intrusion (AISeng Tech / gbhackers citing Malbear Labs, 2026-11-09): Researchers discovered an attack campaign named "Operation Snowball", in which a jailbroken AI agent, with almost no human intervention, carried out a two-week intrusion against a European telecom supplier and 13 organisations it hosted. Running on a jailbroken DeepSeek Flash model with a million-character context window, the agent independently logged each target, credential, and failed attempt and adapted its tactics; the human operator only issued sparse high-level instructions in Chinese such as "continue". The incident shows attackers can now sustain cross-week, adaptive intrusions, greatly reducing the manpower required.
Munich Re: Enterprise Cyber Insurance Demand Surges but Awareness Gap Remains Wide (Risk & Insurance citing Munich Re, 2026 Global Cyber Risk and Insurance Survey): This survey covering over 9,500 people across 20 countries found that 43% of global senior decision-makers are considering and highly likely to purchase cyber insurance (versus 35% in 2021); yet among respondents without cyber insurance, 26% still said they did not know such a product exists and 21% said they did not understand its coverage (up from 15% in 2021). A Google threat intelligence analyst noted that AI-assisted large-scale reconnaissance and automated vulnerability scanning are making SMEs and non-US institutions low-cost, high-frequency extortion targets — "being small or outside the US" is no longer a reason for immunity.
FATF Warns of the Industrialisation of AI-Driven Fraud (fintech.global citing the Financial Action Task Force, 2026-11-09): FATF's new report synthesised about 120 cases across more than 60 jurisdictions, noting that criminal networks use deepfakes, AI-generated content, and automation to expand scam-park-style fraud to a pace authorities struggle to keep up with, causing tens of billions of dollars in losses each year; in Myanmar alone an estimated 120,000 people are coerced into scam operations, with victims and operators spanning at least 80 countries. The report urges financial institutions to act within 24 to 72 hours of a scam being reported.
Mainland's "Qinglang" Special Campaign Targets AI Application Disorder (CCTV.com, 2026-11-09): The new round of the "Qinglang · Curbing AI Application Disorder" campaign brings AI technology risks back into ordinary users' daily scenarios, covering deepfake infringements of portrait and reputation, impersonation of virtual personas for fraud, excessive emotional inducement, and agents operating beyond authority without users' full awareness. Regulators require platforms to inform users in plain language of the autonomy, memory scope, and external-call permissions of intelligent services, and to explore dynamic authorisation mechanisms — whenever an agent is about to perform an action beyond a routine query, a separate confirmation must be triggered.
The content of this column is provided for general information and educational purposes only, and does not constitute insurance, legal, or professional advice. Actual coverage is subject to the terms of individual policies.