A Chinese-speaking threat actor is using DeepSeek as the reasoning engine behind the open-source Hermes Agent to conduct autonomous cyberattacks on exposed servers with minimal human involvement, according to findings published Thursday by Palo Alto Networks' Unit 42 researchers.

The Autonomous Attack Framework

The campaign came to light after the attacker accidentally exposed their own infrastructure. While running in unattended mode, Hermes created a web server from its home directory, inadvertently exposing API keys, exploit scripts, target lists, shell history, and detailed AI attack logs. Unit 42 attributed the activity to an actor operating under the aliases 'knaithe' and 'KnYuan,' who self-describes as a 'binary security researcher.' The attacker configured Hermes with access to a Telegram channel for command-and-control, integration with the FOFA internet asset search engine, and custom offensive-security skills designed for vulnerability research and exploitation.

How DeepSeek Powered the Attacks

Unit 42 recovered a May 2026 session that demonstrates the real-world potential of AI-assisted attack workflows. The operator provided only an initial task directive before stepping back entirely. Hermes then autonomously selected targets, downloaded exploit code from public repositories, scanned for vulnerable systems, and attempted compromises—all without further human input. The agent first targeted internet-exposed Langflow servers vulnerable to CVE-2026-33017, identifying 84 exposed instances through FOFA queries before determining those particular targets couldn't be exploited with available tools.

Target Selection and Exploitation

When the initial approach failed, Hermes didn't stall—it pivoted. DeepSeek's reasoning capabilities allowed the agent to analyze multiple public exploit repositories, select a new vulnerability chain targeting the n8n workflow automation platform (CVE-2026-33058 chained with CVE-2025-68613), and identify over 647,000 exposed instances running vulnerable versions. The agent scanned each target for unauthenticated file-upload forms required to complete the attack chain. While these autonomous attempts ultimately failed due to authentication requirements on available entry points, the workflow itself represents a functional end-to-end offensive capability that could be refined.

The Manual Backup Operations

Despite deploying sophisticated AI automation, the threat actor didn't abandon traditional methods entirely. Unit 42 documented manual attacks against more than 460 systems using vulnerabilities affecting Citrix NetScaler (CVE-2026-3055), Apache Tomcat, Marimo Notebook, Windows IKE VPN, and other products. Three of these manual operations succeeded with the Citrix NetScaler exploit, allowing the actor to extract memory contents and search for authentication cookies that could enable session hijacking. The attacker had also configured alternative AI coding platforms including Qwen, GLM, Kimi, MiniMax, Claude Code, and OpenAI's Codex, though Unit 42 found limited evidence of active use with these tools.

Why This Matters

The significance here isn't in the individual vulnerabilities or targets—it's in the workflow. Hermes executed hundreds of hours of manual targeting analysis in mere minutes while simultaneously managing its own compute resources. Target identification, scope narrowing, exploit selection, and execution all happened autonomously after a single human prompt. 'This autonomous process of target identification, sampling and narrowing of scope is notable because the system executed hundreds of hours of manual targeting analysis in mere minutes,' Unit 42 explained.

Precedent for AI-Powered Intrusions

The exposed campaign follows a related incident disclosed last week involving Thailand's Ministry of Finance. In that case, poorly secured Hermes infrastructure revealed exploit tools, web shells, credentials, compiled payloads, and activity logs showing the agent automating post-exploitation tasks in YOLO mode—enumerating services, inspecting containers, traversing filesystems, and cataloging documents. However, that earlier incident required a human operator to supply targets and objectives; Hermes merely automated routine activity after initial access had already been obtained.

Key Takeaways

  • DeepSeek powered an end-to-end autonomous attack workflow using the open-source Hermes Agent framework
  • The agent independently selected targets, downloaded exploits, and attempted compromises without human intervention
  • Manual attacks against 460+ systems supplemented AI operations, with three successful Citrix NetScaler compromises
  • Accidental exposure of the operator's infrastructure revealed API keys, logs, and complete attack methodology

The Bottom Line

This is a preview of where offensive security is heading—not science fiction, not theoretical risk. We've got a working autonomous attack system in the wild, and it only took one misconfigured web server to expose the whole operation. Organizations running internet-exposed services need to assume that AI-assisted reconnaissance and exploitation are now baseline capabilities for motivated threat actors.