A Chinese hacker group deployed AI models including DeepSeek to conduct autonomous cyberattacks on vulnerable servers with minimal human intervention, according to researchers at Palo Alto Networks' Unit 42. The threat actor, operating under the aliases "knaithe" and "KnYuan," used a Hermes Agent with DeepSeek as its reasoning engine. A configuration mistake inadvertently exposed the attacker's complete infrastructure, allowing security researchers to analyze the full scope of the operation.
Key Facts
- Hermes Agent with DeepSeek: The AI agent performed autonomous vulnerability scanning, downloaded exploit code from GitHub, and launched attacks without further human input
- Multiple LLMs deployed: Beyond DeepSeek, the actor used Qwen, GLM, Kimi, and MiniMax; Western models like Claude Code saw only limited testing according to researchers
- Massive target identification: The agent identified over 647,000 internet-exposed n8n servers globally, including more than 25,000 in China
- No successful compromises: Despite autonomous attacks, the agent failed to achieve actual system breaches
How the Automated Attack Worked
After receiving instructions via Telegram, the agent operated entirely autonomously. It searched internet-facing systems using the FOFA search engine, downloaded publicly available exploits, and executed attacks without requiring operator intervention.
In one documented session, the agent targeted a Langflow vulnerability (CVE-2026-33017, CVSS 9.8). It identified 84 exposed Langflow servers but failed to compromise any because the required configuration was not enabled. DeepSeek then assessed the product as a "low-value target" and shifted strategy.
"This autonomous process of target identification, sampling and narrowing of scope is notable because the system executed hundreds of hours of manual targeting analysis in mere minutes, while also managing its own compute resources," Unit 42 wrote.
Intelligent Target Selection by AI
The agent next analyzed public exploit repositories and selected n8n (a workflow automation platform) as its next target—because FOFA showed over 647,000 exposed instances worldwide. The agent chained two vulnerabilities: CVE-2026-21858 (arbitrary file read, CVSS 10.0) and CVE-2025-68613 (sandbox escape with RCE, CVSS 9.9). It recognized that n8n version 1.117.3 predated both patches and remained vulnerable.
| Aspect | Details |
|---|---|
| Primary Model | DeepSeek (as reasoning agent) |
| Additional LLMs | Qwen, GLM, Kimi, MiniMax |
| Search Engine | FOFA |
| Exploit Source | GitHub |
| Communication | Telegram |
| Successful Compromises | None documented |
This capability is remarkable: the agent performed analyses in minutes that would have required hundreds of manual hours—while managing its own computational resources.
What This Means
This case demonstrates that frontier models outside Western control are now being weaponized not just for development but for attack orchestration. For organizations globally, the automation of vulnerability discovery and exploit selection dramatically lowers the barrier to entry for cyberattacks. While no successful compromises were documented in this instance, the methodology shows that AI-driven attacks are scalable and difficult to prevent—especially when they leverage publicly available exploits and search engines. Organizations should assume that such autonomous scanning and exploitation attempts are already routine.
Sources
Editorially owned by Ideal Syka. Sources and method: Newsroom & method. Tips and corrections: ai@i6eal.de.
