A Chinese-speaking threat actor has been using a sophisticated AI-powered attack framework to autonomously target vulnerable servers with limited human involvement. The campaign, discovered by Palo Alto Networks’ Unit 42 researchers, utilizes the DeepSeek AI model and the open-source Hermes Agent to identify, evaluate, and attack exposed systems.
The activity was uncovered after the Hermes Agent accidentally created a web server from its home directory, exposing the attacker’s environment, including API keys, exploit scripts, target lists, shell history, and AI attack logs. The exposed data revealed that the threat actor is operating under the aliases “knaithe” and “KnYuan,” who describes themselves as a “binary security researcher.”
While the observed attacks did not successfully compromise any targeted servers, Unit 42’s findings illustrate an end-to-end autonomous offensive capability capable of discovering, evaluating, and attacking vulnerable systems. The researchers attribute the campaign to a China-based threat actor operating with limited human involvement.
At the heart of this operation is DeepSeek, an AI reasoning engine used in conjunction with the Hermes Agent, an open-source framework that interacts with operating system terminals, runs commands, and connects to the internet. The agent’s “Yolo” mode allows it to operate autonomously without requiring permission from its operator, making it a highly efficient tool for conducting attacks.
In one notable session, the threat actor provided only an initial task, after which the Hermes Agent conducted the remaining activity independently, scanning for vulnerabilities and selecting targets to exploit. The agent first targeted Langflow servers vulnerable to CVE-2026-33017, downloading a public proof-of-concept exploit and identifying 84 exposed instances through FOFA.
After determining that the available targets could not be exploited, the agent searched for other potential vulnerabilities to scan. DeepSeek then analyzed multiple public exploit repositories before selecting the n8n workflow automation platform to target, which had more than 647,000 exposed instances identified through FOFA. The agent downloaded an exploit that chained CVE-2026-21858 and CVE-2025-68613, but ultimately failed to compromise any targets due to authentication requirements.
The campaign’s significance lies in the agent’s ability to independently research vulnerabilities, determine optimal targets, download exploit code, and attempt to exploit found targets in mere minutes. This autonomous process would normally require hundreds of hours of manual targeting analysis.
While the AI agent was used extensively in this operation, the threat actor also conducted manual attacks against more than 460 systems using various vulnerabilities. Unit 42 confirmed three successful compromises targeting Citrix NetScaler vulnerability CVE-2026-3055, which allowed the attacker to extract memory and search for authentication cookies.
As this incident highlights the increasing sophistication of AI-powered attack frameworks, it’s essential for organizations to take proactive measures to protect their systems from autonomous threats. This includes regularly updating software, implementing robust security protocols, and staying informed about emerging vulnerabilities and exploits. By understanding the capabilities and limitations of these advanced tools, we can better prepare ourselves against the evolving cyber threat landscape.
Source: Bleeping Computer — 2026-07-31