A China-based threat actor used the DeepSeek AI model together with the open-source Hermes Agent to carry out largely autonomous cyberattacks against internet-exposed servers, according to researchers at Palo Alto Networks' Unit 42.
The activity came to light after Hermes mistakenly created a web server from its home directory, exposing the attacker's environment. Researchers recovered API keys, exploit scripts, target lists, shell history, and AI attack logs, that allowed them to reconstruct the campaign.
Unit 42 attributed the operation to an actor, tracked as ‘knaithe’ and ‘KnYuan,’ the team described as “an opportunistic exploit operator and self-described binary security researcher.”
Researchers found that DeepSeek acted as the reasoning engine for Hermes Agent, which can interact with operating system terminals, execute commands, browse the internet, and operate in a ‘Yolo’ mode that allows risky actions without user approval. The framework was also connected to the FOFA internet asset search engine and received tasks through a Telegram channel.
A recovered session from May 2026 showed the operator providing only an initial objective before the AI agent completed the remaining steps independently. The agent first searched for internet-facing Langflow servers vulnerable to CVE-2026-33017, downloaded a public proof-of-concept exploit, identified over eighty exposed systems through FOFA, and assessed them for exploitation. When no viable targets were found, it automatically shifted to identifying other vulnerabilities.
DeepSeek then analyzed public exploit repositories and selected the n8n workflow automation platform as its next target after identifying more than 647,000 exposed instances through FOFA. The agent downloaded an exploit chaining CVE-2026-21858 and CVE-2025-68613, located servers running affected versions, and checked for unauthenticated file-upload endpoints. The attacks ultimately failed because the required upload forms required authentication.
Although the autonomous attacks did not successfully compromise the targeted systems, Unit 42 said the workflow demonstrated an end-to-end offensive capability. The AI agent independently researched vulnerabilities, selected targets, retrieved exploit code, and attempted exploitation in minutes, significantly reducing the time normally required for manual reconnaissance and attack preparation.
Alongside the AI-assisted activity, the threat actor manually targeted more than 460 systems using vulnerabilities affecting Citrix NetScaler, Apache Tomcat, Marimo Notebook, Windows IKE VPN, and other software. Researchers confirmed three compromises involving Citrix NetScaler vulnerability (CVE-2026-3055), which was used to dump system memory and search for authentication cookies that could enable session hijacking.
Unit 42 also found configurations for other AI coding platforms, including Qwen, GLM, Kimi, MiniMax, Claude Code, and OpenAI Codex, although those tools appeared to be rarely used during the observed campaign.