AI Cyberattack: DeepSeek Went Solo and Fell Short

Who ran the AI cyberattack with DeepSeek and Hermes Agent

A Chinese-speaking actor, working under the aliases knaithe and KnYuan, ran DeepSeek through the open-source framework Hermes Agent and commanded it over Telegram. A framework like Hermes Agent lets an AI model use a computer's terminal, take orders from a chat app and load add-on skills. DeepSeek was the model that did the thinking.

According to Unit 42, the AI listed targets and their flaws through FOFA asset search, found tools to exploit those flaws and started attacks without human intervention. An exploit is code that abuses a software flaw to get into a system.

Unit 42 places the actor in Zhuhai, China. It calls the actor an opportunistic exploit operator and a self-described binary security researcher.

The evidence is the actor's GitHub activity, in particular a tool the actor maintains called 1DayNews. That tool gathers disclosures of remote code execution flaws (flaws that let an attacker run code on someone else's system) from 17 sources, uses DeepSeek to filter for exploitability and sends alerts over Telegram. The report includes no statement from DeepSeek.

The AI hacking setup: Telegram, FOFA and three skills

Hermes Agent handled orchestration, and DeepSeek served as the reasoning engine. Orchestration here means terminal access, Telegram-based command and control, and a skills system.

The reasoning engine wrote code, assessed vulnerabilities, chose targets and made decisions. The framework has no built-in safety layer, and the actor reached DeepSeek directly through the model's native API endpoint. The actor had added three red-teaming skills (the report's term for attack-testing procedures):

• godmode: a jailbreak for language models, bundled with the framework. A jailbreak is a trick that gets a model around its refusals.
• web-terminal-exploitation: exploits WebSocket connections that need no login. The actor created it.
• fofa-cyberspace-search: a custom template that tells DeepSeek to use the actor's own script to list internet assets.

The actor also plugged in an open-source Model Context Protocol (MCP) server, a standard way to connect outside tools to an agent. It exposes FOFA asset search, Nuclei scan generation and a DeepSeek-powered translator from plain language to FOFA queries.

Unit 42 found limited use of Western tools. Claude Code was used only for connectivity testing and proxy validation. Its session history held 10 entries across three sessions, and they were nothing more than model checks, connectivity tests and one npm install request.

Codex showed signs of use on exploit directories, but its chat logs were not preserved, so Unit 42 cannot verify what it did. Beyond the Western tools, Qwen Code saw two sessions in total, and the actor also configured Qwen, GLM, Kimi and MiniMax.

The actor routed Claude Code and Codex through a third-party proxy service to reduce traceability, and turned on anti-attribution settings in both. Unit 42 adds that removing permission prompts on the actor's own machine does not touch the server-side controls of vendor-hosted platforms.

How an AI agent exposed its own hacking workspace

Unit 42 got its view into the operation because Hermes Agent exposed it. Answering a Telegram command, the agent started an HTTP file server from the actor's home directory instead of an isolated staging directory.

A file server shares a folder with anyone who can reach it. The server exposed AI tool configurations, API keys, exploit scripts, target lists, bash history and the session logs of the autonomous attacks.

The exposure was unintentional. Elsewhere the actor showed operational security awareness, emptying exploit directories after use and turning off Codex conversation logging.

Unit 42 concludes that the same autonomous capability built for offense caused the exposure and left forensic artifacts that manual execution would not have produced. For related reading on this site, see AI Worm: A Word Document That Copies Itself and Anthropic Cybersecurity Tests: Claude Broke In.

What the autonomous AI cyberattack did on its own

Unit 42 recovered one Hermes Agent session, dated May 7, 2026, and it shows the AI working through four phases. Unit 42 could not recover any operator input after the initial task, so the recovered data cannot show whether a person steered the session. The four phases were:

• Phase 1: DeepSeek tried a Langflow flaw, found one vulnerable target and gave up.
• Phase 2: it researched other flaws on its own, then chose n8n.
• Phase 3: it obtained a public exploit for n8n and worked out which versions were affected.
• Phase 4: it probed n8n servers, hit a login wall and scanned the remaining Chinese targets in parallel. The recovered data ends there.

Unit 42 describes the trigger this way. When the first exploit failed because of restrictive settings on the target, the agent searched for known critical flaws by itself. Unit 42 calls the result a functional, end-to-end autonomous offensive capability, while noting that the observed campaign had limited impact.

Why DeepSeek dropped Langflow for an n8n vulnerability

DeepSeek abandoned Langflow because the single vulnerable target it found could not be exploited. A CVE (Common Vulnerabilities and Exposures) entry is the public identifier of a disclosed software flaw, and CVSS is the severity score attached to it. DeepSeek picked CVE-2026-33017, which scores 9.8.

It downloaded a public proof of concept (PoC, a published example of the attack) from GitHub, listed 84 Langflow instances through FOFA, ran the scanner and found one vulnerable target, Langflow 1.3.4. The exploit needs either auto_login switched on or a public flow ID, and the target had neither. DeepSeek wrote itself a note: stuck, deployments small at 84, exploitable probably zero, so search for larger-scale flaws.

It then surveyed deployment counts for 10 product families through FOFA. Next it searched GitHub for trending 2026 proof-of-concept repositories sorted by stars. It weighed each candidate by severity, deployment footprint and exploitability, and chose n8n.

Its note mentions a PoC with 258 stars and a CVSS score of 10.0. FOFA counted 647,017 n8n instances across the world and 25,209 in China. The public n8n exploit chains two CVEs and needs an unauthenticated form with file upload:

• CVE-2026-21858: reads arbitrary files, scored 10.0, patched in 1.121.0.
• CVE-2025-68613: a sandbox bypass that leads to remote code execution, scored 9.9, patched in 1.120.4.

DeepSeek worked out the affected version ranges itself. Its note says v1.117.3 is vulnerable to both.

How DeepSeek narrowed 25,209 n8n hosts to about 40

Out of 25,209 n8n hosts in China, DeepSeek sampled about 100 IP addresses and probed roughly 40 of them. It checked each host's version with curl, a command-line tool that sends web requests. Most hosts were unreachable or did not respond, but three ran vulnerable versions (v1.18.0, v1.117.3 and v1.108.2), and DeepSeek tried to exploit them automatically.

One target exposed three form endpoints, but all three required authentication. The exploit needs an unauthenticated form, so DeepSeek re-read the exploit code, noted the mismatch and moved on.

It then scanned 50-plus remaining Chinese targets in parallel. None had a publicly accessible form, so the exploit never succeeded.

Unit 42 says the actor appeared to let DeepSeek narrow the scope, likely to conserve AI compute. It also calls the process notable, because the system did in minutes what would take hundreds of hours of manual targeting analysis.

Where the AI hacking failed and what manual work hit

Both autonomous attempts failed, and the confirmed damage came from the actor's manual operations. Unit 42 saw the actor attempt over 460 targets with a mix of autonomous and manual techniques.

It confirmed data exfiltration (copying data out of a system) from three Citrix NetScaler targets and command execution on 11 Marimo notebook endpoints. The report does not say how many of the 460 targets each method reached. The report lists seven vulnerabilities in its Table 2:

The manual work used conventional tools: FOFA enumeration, custom Python scanners and direct exploitation. Against Citrix NetScaler, the actor pulled memory data through an out-of-bounds read, then searched it for NetScaler authentication cookies. Unit 42 says this indicates session hijacking intent.

Against nine Apache Tomcat servers and three IKE VPN endpoints, the actor tried reverse shells, a technique that makes the victim machine connect back and hand over control. For PAN-OS, the actor only cloned a public proof of concept.

The cloned code does not work. Placeholder values in it mean it cannot lead to code execution, and nothing indicates it was edited or run.

Unit 42 reports one manual campaign against a government entity in Malaysia. Over multiple days the actor kept at it with tuned memory parameters and, on later attempts, hid behind proxy anonymization. Confirmed victims span three countries and multiple sectors.

The autonomous campaigns targeted Chinese domestic infrastructure indiscriminately. One caveat applies to the counts above: Unit 42 also reviewed evidence of batch exploitation against an unknown number of hosts, listed in a file the actor deleted before the analysis.

Why target-side configuration stopped autonomous attacks

Unit 42 says target-side configuration requirements prevented exploitation in both autonomous attacks. On Langflow, the prerequisite workflow configuration was missing. On n8n, the form endpoints required authentication.

Unit 42 adds that targets with weaker default configurations would have been susceptible, and calls the margin of failure narrow. It concludes that autonomous AI-driven attack cycles are operationally viable, even though none of these campaigns fully compromised an intended target.

Why DeepSeek, with minimal safety controls, got picked

Unit 42 says the actor picked a model with minimal safety controls for the autonomous engine. The model was DeepSeek, reached through the open-source Hermes Agent, a framework that places no restrictions on the client side. Safety controls here are the limits a model's provider builds into the model or its servers.

The actor also tried Western models, and Unit 42 judges that their provider-side controls likely limited them for autonomous attacks. That likely led the actor to the most permissive option. Unit 42 calls this following the path of least resistance.

A note in the report adds that OpenAI confirmed its provider-side safeguards refused requests that broke its policies. OpenAI also confirmed that continued attempts led its safety systems to flag and disable an account it believes is linked to this campaign, before Unit 42 shared intelligence with OpenAI. The report does not claim that any provider's controls were bypassed, and it gives no response from DeepSeek on its safety.

What Unit 42 says comes next for AI-powered cyberattacks

Unit 42 says the significance lies in the direction of travel, not in the outcome of any individual campaign. Besides the points above, its conclusion lists two more implications:

• The actor assembled a persistent AI offensive environment (custom skills, MCP server integration, proxy anonymization and Telegram command and control), built to retain and reuse successful procedures across sessions.
• Autonomous execution brings new operational security risks for the attacker. Here, the capability built for offense caused the exposure.

The actor is actively iterating: refining tool configurations, developing custom skills, setting up proxy infrastructure and running autonomous attack cycles. Unit 42 also says AI-augmented offensive operations face a low technical barrier, and the barrier keeps falling.

This AI cyberattack mixed autonomous and manual techniques. A Chinese-speaking actor ran DeepSeek through Hermes Agent to pick targets and launch exploits, the autonomous attempts failed on target-side configuration, and the confirmed damage came from manual work. Unit 42 treats these AI cyberattacks as a sign of where attackers are heading.