A Chinese-speaking hacker used the DeepSeek AI model to autonomously identify targets and launch cyberattacks against more than 460 systems, according to a report published by Palo Alto Networks' Unit 42. The threat actor, tracked under the aliases knaithe and KnYuan, controlled DeepSeek through the open-source Hermes Agent framework, which provided terminal access and unattended execution capabilities. After receiving a single instruction via Telegram, the AI agent searched for internet-facing systems and chose public exploits with no additional human input during the session.
The autonomous attacks targeted seven different exploit tracks spanning eight CVE identifiers, including vulnerabilities in Langflow, n8n, Marimo, and NetScaler systems. In a recovered session from May 2026, DeepSeek downloaded a public exploit for the Langflow code-injection flaw CVE-2026-33017, searched for 84 instances through FOFA, and identified one target running version 1.3.4. When that attack failed because the system lacked required configuration settings, the AI agent surveyed 10 product families, searched GitHub for recent proof-of-concept code, and switched to targeting n8n workflow automation platforms. FOFA returned 25,209 n8n systems in China during the session, and DeepSeek sampled roughly 100, probed about 40, and found three running vulnerable versions. The report confirms only three successfully exploited targets across the entire operation, though it separately states the operator extracted data from three organizations through the NetScaler memory flaw CVE-2026-3055 and executed commands on 11 Marimo instances through CVE-2026-39987.
Unit 42's investigation recovered the operator's model configurations, API keys, exploit scripts, target lists, shell history, and autonomous-session logs because the Hermes Agent framework inadvertently started an unintended HTTP server from the /home/worker directory. The researchers found DeepSeek served as the primary reasoning model, with limited use of Claude Code and Qwen Code, plus signs of Codex in exploit-development directories that couldn't be verified because chat logs weren't preserved. The report assesses the operator is based in Zhuhai, China—a conclusion consistent with public material showing the GitHub profile displays the name "KnYuan Knaithe" and an older blog under the same handle describes its author as a binary security researcher in that city, though those profiles don't establish legal identity or any state connection.
The autonomous agent demonstrated decision-making that mirrors human attacker behavior: it checked software versions, downloaded exploits, abandoned unproductive approaches, and selected new vulnerabilities based on severity scores, deployment scale, and apparent ease of exploitation. The DeepSeek-led attacks against Langflow and n8n both failed because the exposed systems didn't meet the exploits' configuration requirements—authentication barriers and missing public endpoints blocked access even when vulnerable versions were running. This shows AI-driven attacks still face the same practical obstacles that stop conventional intrusion attempts, but the framework's ability to operate without human oversight means a single instruction can trigger sustained reconnaissance and exploitation across thousands of potential targets.
Organizations should immediately patch exposed Langflow, n8n, and Marimo systems, along with customer-managed NetScaler ADC or Gateway appliances configured as SAML identity providers, the report states. Langflow fixed CVE-2026-33017 in version 1.9.0, while n8n version 1.121.1 is the earliest release addressing both flaws used in the attempted exploit chain. Marimo patched CVE-2026-39987 in version 0.23.0, and Citrix published fixed builds for CVE-2026-3055 in its security bulletin. Administrators should also remove unnecessary public access to workflow and notebook interfaces, cutting off the initial reconnaissance that lets autonomous agents discover potential targets in the first place.