Palo Alto Networks Unit 42 has uncovered an AI-enabled hacking campaign in which a Chinese-speaking threat actor used DeepSeek through the open-source Hermes Agent framework to conduct autonomous cyberattack activity.
The actor, operating under the aliases knaithe and KnYuan, used Telegram to orchestrate the agent. After an initial task was sent, the AI-driven system was able to enumerate targets, research vulnerabilities, source public exploit tools, and attempt attacks with little or no additional human input.
This is not just another case of an attacker asking an AI chatbot for help.
It is a more serious evolution: an AI model connected to tools, internet search, terminal access, target enumeration, and unattended execution.
What Happened
Unit 42 gained visibility into the operation after the attacker’s Hermes Agent accidentally exposed its working environment through an unintended web server.
That exposure revealed model configurations, API keys, exploit scripts, target lists, shell history, and autonomous session logs. This gave researchers a rare look into how the actor had assembled and operated an AI-powered offensive workflow.
According to Unit 42, DeepSeek was used as the primary reasoning engine for the attack phase. Hermes Agent provided the orchestration layer, including terminal access, Telegram-based command and control, reusable skills, and unattended task execution.
In simple terms:
DeepSeek made decisions. Hermes executed the workflow. Telegram acted as the control channel.
DeepSeek as the Offensive Reasoning Engine
The actor configured Hermes Agent so that DeepSeek could help with:
- vulnerability assessment
- target selection
- code generation
- exploit research
- tool selection
- decision-making during failed attack paths
Hermes Agent was also customized with red-team-oriented skills and integrated with FOFA, an internet asset search engine, to discover exposed systems. Unit 42 also found integration with an MCP server that supported FOFA asset search, Nuclei scan generation, and natural-language-to-FOFA query translation.
This matters because it shows how attackers are moving beyond simple AI-assisted scripting.
They are building persistent offensive AI infrastructure where the model can reason, choose, pivot, and continue the attack flow.
The Autonomous Attack Flow
In one recovered May 2026 session, Unit 42 found that DeepSeek first targeted exposed Langflow instances using a known critical vulnerability.
The agent identified the vulnerability, found exposed instances through FOFA, downloaded public exploit code, scanned targets, and identified one vulnerable version. However, the exploitation attempt failed because the target did not meet the configuration conditions required for successful exploitation.
The important part is what happened next.
Instead of stopping, the agent pivoted.
DeepSeek searched for other high-value vulnerabilities, surveyed deployment counts across multiple product families, checked public exploit repositories, and selected n8n, a workflow automation platform, as the next target. Unit 42 said FOFA showed more than 647,000 exposed n8n instances globally, including more than 25,000 in China during the session.
The n8n attack path also failed because the discovered targets required authentication or lacked the exposed forms needed for the exploit chain.
But the failure does not make the campaign unimportant.
The agent still performed the work a human operator would normally do: identify a failed path, reassess the target landscape, select a new target, obtain tooling, check versions, and attempt exploitation.
More Than 460 Targets Attempted
Unit 42 identified more than 460 attempted targets across both autonomous and manual activity.
The autonomous DeepSeek-led campaigns against Langflow and n8n did not result in confirmed compromise. However, the same actor also conducted manual operations with confirmed impact, including data exfiltration from three Citrix NetScaler targets and command execution on 11 Marimo notebook endpoints.
This distinction matters.
The fully autonomous part of the campaign did not successfully compromise its intended targets, but it came close enough to demonstrate a working attack model. The successful compromises came from the broader operator activity using conventional methods.
The takeaway is not that AI replaced the attacker completely.
The takeaway is that AI significantly accelerated the attacker’s ability to discover, prioritize, and attempt exploitation at scale.
Why This Campaign Matters
This campaign shows that autonomous AI-driven cyber operations are becoming operationally viable.
The agent was not just producing text. It was connected to tools and infrastructure that allowed it to act.
It could search for targets, evaluate exposed services, compare vulnerabilities, obtain public exploit code, test attack paths, and pivot when one path failed. Unit 42 said the system compressed what could have been hundreds of hours of manual targeting analysis into minutes.
That changes the economics of cyberattacks.
A single operator can now build an AI-assisted workflow that performs large parts of reconnaissance and vulnerability triage automatically.
Even when exploitation fails, the attacker saves time.
Why DeepSeek Was Chosen
Unit 42 found that the actor experimented with several AI coding tools and models, including limited use of Claude Code, Qwen Code, and signs of Codex activity in exploit-development directories.
However, DeepSeek through Hermes Agent became the primary offensive setup. Unit 42 assessed that the actor likely selected the most permissive model and framework combination because it provided fewer client-side restrictions for autonomous attack activity.
Unit 42 also said OpenAI confirmed that its provider-side safeguards refused policy-violating requests and that continued attempts led safety systems to flag and disable an account believed to be linked to the campaign.
This is an important point for defenders and AI vendors.
Attackers will test different tools and choose the path of least resistance.
The AI Also Exposed the Attacker
One of the more ironic parts of the campaign is that the same automation designed to help the attacker also created an operational security failure.
Hermes Agent unintentionally exposed the attacker’s environment, making API keys, exploit scripts, target lists, history, configurations, and session logs accessible to researchers.
This shows a new defensive opportunity.
Autonomous attack systems may create new artifacts: logs, prompts, intermediate reasoning, tool outputs, generated scripts, cached data, and configuration files.
Those artifacts can help defenders reconstruct what happened in ways that may not exist in fully manual operations.
What Defenders Should Watch
Organizations should treat this campaign as a warning about exposed infrastructure, especially AI workflow tools, automation platforms, notebooks, and internet-facing management services.
Security teams should prioritize:
- removing unnecessary public exposure from workflow and notebook platforms
- patching exposed Langflow, n8n, Marimo, NetScaler, Tomcat, VPN, and perimeter systems
- monitoring for automated reconnaissance patterns
- detecting unusual FOFA-style enumeration activity
- reviewing logs for rapid version checks and vulnerability probes
- blocking access to sensitive admin panels from the public internet
- applying authentication to workflow forms, notebooks, APIs, and dashboards
- treating AI agent tooling as part of attacker infrastructure
The n8n and Langflow attempts failed largely because the target environments did not meet the required exploit conditions. That is the key defensive lesson: secure configuration still matters.
AI Is Changing the Attack Timeline
This campaign does not prove that AI agents can always compromise targets end to end.
But it does prove something equally important: attackers can now use AI agents to dramatically speed up the boring but essential parts of offensive work.
Target discovery.
Version checking.
Public exploit research.
Exposure analysis.
Attack-path selection.
Retargeting after failure.
These are exactly the steps that make real-world campaigns slow for human operators.
AI reduces that friction.
For defenders, that means patch windows are shrinking, exposed systems will be tested faster, and misconfigurations will be found more quickly.
Final Thoughts
The DeepSeek and Hermes Agent campaign is a clear sign of where offensive AI is heading.
The actor did not need a perfect autonomous hacker. They only needed a system that could reduce manual effort, identify promising targets, and keep working after failure.
That is enough to change the threat model.
The campaign had limited confirmed impact, but the workflow matters more than the final victim count. It shows that threat actors are building reusable AI-powered attack infrastructure with Telegram control, search integration, custom skills, exploit retrieval, and autonomous decision-making.
Autonomous cyberattacks are no longer theoretical. Defenders need to secure exposed services, reduce internet-facing attack surface, patch faster, monitor for machine-speed reconnaissance, and prepare for attackers who use AI not only to write code, but to run the campaign.
