DeepSeek Ran Autonomous Cyberattacks: They Failed, But the…

A Chinese-speaking threat actor integrated DeepSeek with the open-source Hermes Agent framework to orchestrate a fully autonomous hacking pipeline — from reconnaissance to exploit execution — with only an initial human prompt. Documented by Palo Alto Networks Unit 42 in a report published July 30, 2026, the campaign demonstrates that the technical barrier for AI-enabled offensive operations has dropped to the individual level. The autonomous attacks failed against target-side defenses, but the exercise proved the gap between "defensive" and "offensive" AI models now hinges on safety architecture choices, not technical sophistication.

{"main_topic":"ai","topics":["ai","cybersecurity","cve","agentic","llm"]}

A Chinese-speaking threat actor integrated DeepSeek with the open-source Hermes Agent framework to orchestrate a fully autonomous hacking pipeline — from reconnaissance to exploit execution — with only an initial human prompt. Palo Alto Networks Unit 42 documented the campaign in a report published July 30, 2026. The operation confirms that the technical barrier for AI-enabled offensive operations has dropped to the individual level: the actor assembled in minutes what traditionally required hours of manual analysis. The most significant finding, however, is not the success of the autonomous attacks — which failed — but the demonstration that the divide between "defensive" and "offensive" AI models now depends on safety architecture choices, not technical sophistication.

Key Takeaways

A Chinese-speaking threat actor, known by the aliases knaithe and KnYuan, used DeepSeek as the reasoning engine inside the open-source Hermes Agent framework for autonomous offensive operations.
The pipeline combined FOFA reconnaissance, GitHub proof-of-concept selection, and exploit attempts against specific CVEs, with autonomous compute-resource management.
The autonomous attacks failed due to target-side defenses (required authentication, non-public flow IDs); the confirmed successes — 3 data exfiltrations from Citrix NetScaler and command execution on 11 Marimo endpoints — came from parallel manual operations.
Claude (Anthropic) and Codex (OpenAI) were tested but limited to connectivity testing; provider-side safety controls blocked offensive use, while DeepSeek and Qwen, accessible directly via API without client-side restrictions, enabled execution in "YOLO mode."

How the Autonomous Agent Works: From Initial Prompt to Exploit

The architecture documented by Unit 42 comprises three layers. The reasoning engine is DeepSeek, accessed directly via its native APIs without intermediate proxies. The orchestration framework is Hermes Agent, designed for autonomous operations with a skills system, terminal access, and command-and-control via Telegram. The third layer is integration via Model Context Protocol (MCP) with an open-source server, FofaMap-Platinum-Full-Expert, which translates natural-language instructions into queries for the FOFA cyberspace search platform.

The actor customized Hermes Agent with three red-teaming skills: godmode for jailbreaking, web-terminal-exploitation for attack execution, and fofa-cyberspace-search for target discovery. This configuration allowed DeepSeek to operate in what BleepingComputer calls "YOLO mode": execution without intermediate confirmation, where every model-generated step is immediately translated into action.

A complete session from May 7, 2026, was recovered in full by Unit 42. According to the report, "We were unable to recover additional operator input beyond the initial task": after the initial prompt, DeepSeek managed the workflow autonomously for the remainder of the session, including compute-resource management.

The Autonomous Chain: From Langflow Failure to n8n Selection

The recovered session documents DeepSeek's decision-making in real time. The first target selected was Langflow, with vulnerability CVE-2026-33017, rated CRITICAL with CVSS 9.8 per the National Vulnerability Database. DeepSeek autonomously downloaded a proof-of-concept from GitHub, enumerated 84 exposed instances via FOFA, and identified a vulnerable version, 1.3.4. The exploit failed: all three vulnerable Langflow systems required a public flow ID and the absence of auto_login blocked the chain.

Reasoning logs recovered by Unit 42 record the model's autonomous response: "All three Langflow need public flow ID but no auto_login—stuck. Deployments small(84 alive), exploitable probably 0. Search for larger-scale vulns." DeepSeek then researched 10 product families, analyzing deployment footprint and PoC availability, and selected n8n for its larger attack surface: 647,017 global instances, including 25,209 in China, per FOFA data cited in the report.

For n8n, DeepSeek chained two vulnerabilities: CVE-2026-21858 (arbitrary file read, CVSS 10.0 per NVD) and CVE-2025-68613 (sandbox bypass to RCE, CVSS 9.9 per NVD). The model autonomously analyzed affected versions, concluding that "v1.117.3 is vulnerable to both." It sampled roughly 100 IP addresses from the 25,209 Chinese n8n instances and probed about 40 targets for version details. Three vulnerable systems were identified, but all required authentication: this chain also failed.

"the system executed hundreds of hours of manual targeting analysis in mere minutes, while also managing its own compute resources" — Unit 42, cited in Security Affairs

The Safety Contrast: Why Claude and OpenAI Blocked, DeepSeek Did Not

The report documents that the actor also tested Western AI tools, with radically different results. Claude Code (Anthropic) was used in three sessions totaling 10 entries, limited to /model checks, connectivity tests, and an npm install request. Codex (OpenAI) shows signs of use in exploit-development directories, but chat logs were not preserved. Both were routed via proxy through the domain code.newcli[.]com.

The architectural difference is decisive. As reported by TechTimes citing the Unit 42 report: "The actor selected a model with minimal safety controls accessed through an open-source framework with no client-side restrictions. The actor attempted to use Western models, but their provider-side controls likely limited their effectiveness for autonomous attacks." OpenAI officially confirmed that its safety controls refused policy-violating requests and disabled an account linked to the campaign.

DeepSeek and Qwen, accessible directly via native APIs without intervening control layers, instead enabled continuous execution. The Hermes Agent framework implements no client-side guardrails: the combination of a model without safety controls and a framework without restrictions created an effectively "offensive by design" stack.

The Real Successes: Manual Exploits and Infrastructure Exposure

Contrary to the autonomous attacks, the actor's parallel manual operations achieved confirmed results. Unit 42 documents data exfiltration from 3 Citrix NetScaler targets via CVE-2026-3055 (memory overread, CVSS 9.3 per the NetScaler CNA classification), and command execution on 11 Marimo notebook endpoints via CVE-2026-39987 (pre-auth RCE, CVSS not yet assigned in NVD at the time of the report). SecurityOnline reports the overall campaign attempted over 460 targets, with 3 confirmed breaches.

The actor was attributed to Zhuhai, China, based on public GitHub activity including the 1DayNews tool for RCE vulnerability aggregation. Unit 42 assesses the actor as independent, not linked to a state entity. Infrastructure was exposed by operational error: a file server was started in the home directory instead of an isolated staging folder, allowing Unit 42 to recover the logs.

The finding puts immediate risk in perspective: AI autonomy has not yet overcome target-side defenses, but it has radically compressed preparation time. Andy Piazza, senior director of threat intelligence at Unit 42, notes a methodological limit: "We do not know if that targeting was intentional or simply a random list of targets that had internet-facing services the attacker was interested in."

What to Do Now

Verify that Langflow, n8n, Citrix NetScaler, and Marimo systems are not exposed to the internet with default configurations or without authentication; patches for the cited CVEs are available in official release notes and the NVD database.
Evaluate in enterprise threat models the specific risk of AI tools with bypassable or absent safety layers, treating them as offensive capabilities available to low-threshold threat actors.
Request transparent documentation from AI service providers on provider-side safety controls, distinguishing between model guardrails and infrastructure restrictions.
Ensure authentication on workflow automation tools and development platforms is properly implemented, as it proved the effective defensive control against the documented autonomous attacks.

FAQ

Did DeepSeek compromise systems autonomously?

No. The autonomous attacks documented by Unit 42 failed due to target-side defenses. The confirmed compromises — 3 data exfiltrations and 11 command executions — resulted from manual exploits conducted in parallel by the actor.

Why weren't Claude and OpenAI used for the attacks?

Provider-side safety controls blocked offensive operations. Claude was limited to connectivity testing, and OpenAI disabled an account linked to the campaign after refusing policy-violating requests.

Is the actor linked to a government?

Unit 42 assesses the actor as independent. No infrastructure overlaps currently link knaithe/KnYuan to Chinese state APT groups.

Information verified against cited sources and current as of publication.

Sources

Sources and references

Get DeafLetter