A hacker had DeepSeek attack vulnerable servers autonomously. Unit 42 analyzed what worked and what did not

Palo Alto Networks Unit 42 published its analysis of a campaign in which an attacker used artificial intelligence to autonomously find and attack vulnerable servers. The engine: the DeepSeek model, driven through Hermes Agent — an open-source framework that gives the model a terminal, command execution and internet access. The fact that matters most, and that sensational headlines skip: no autonomous attack succeeded. Below: what the AI actually did, what stopped it, and what to take away.

In brief

• A China-based attacker (aliases “knaithe” / “KnYuan”, self-described “binary security researcher”) had an AI agent autonomously attack exposed servers.
• Reasoning engine: DeepSeek; framework: Hermes Agent (open-source, provides terminal + execution + internet). Also configured and minimally used: Qwen, GLM, Kimi, MiniMax, Claude Code, Codex.
• The agent ran in “Yolo” mode (executing risky commands without operator approval); it got an initial task on a Telegram channel and continued on its own, with no human feedback.
• No autonomous attack compromised a target — the attempts failed at authentication.
• What impressed Unit 42 was the speed: “hundreds of hours of targeting analysis, in minutes.”
• The campaign surfaced because Hermes exposed its own home-directory server: API keys, exploit scripts, target lists, logs.

What the AI did autonomously

In a May 2026 session analyzed by Unit 42, the agent worked on its own:

• It targeted Langflow servers vulnerable to CVE-2026-33017 — 84 exposed instances identified.
• It pivoted to the n8n automation platform — over 647,000 internet-exposed instances.
• It downloaded exploits chaining CVE-2026-21858 and CVE-2025-68613.
• It searched exploit repositories and scanned for vulnerable configurations.

Unit 42 sums up the essence in one line: the system “executed hundreds of hours of manual targeting analysis in mere minutes, while also managing its own compute resources.” That is the news — not a magic breaking capability, but recon scale and speed on autopilot.

What worked and what did not

Here is the nuance worth keeping: the autonomous attacks failed. The upload forms the agent found required authentication, and the AI had no way past it. Fast recon, targeting at scale — but the door stayed shut.

Separately from the autonomous part, the attacker (the human) manually ran campaigns against over 460 systems, exploiting flaws in Citrix NetScaler (CVE-2026-3055 — 3 confirmed compromises), Apache Tomcat, Marimo Notebook and Windows IKE VPNs. The confirmed compromises came from manual work, not from the AI’s autonomy.

How it was discovered

The campaign’s irony: the agent gave itself away. Hermes accidentally exposed a web server from its own home directory, leaving API keys, exploit scripts, target lists, shell history and the logs of the AI-driven attacks in plain view. That is where Unit 42 researchers started.

It is not the first exposure of its kind: earlier, Hunt.io and researcher Bob Diachenko had found similar Hermes infrastructure tied to alleged attacks on Thailand’s Ministry of Finance (post-exploitation automation, after initial access).

What to take away

• Authentication was the decisive layer. The most basic thing — “put a password on the upload form” — stopped the autonomous attacks. AI does not invent access it does not have.
• AI drives the cost of recon toward zero. What took hours of manual work (scanning, correlating CVEs, matching exploits to targets) compresses into minutes. The window between a CVE going public and its exploitation at scale keeps shrinking.
• Exposed services are the attack surface. Langflow, n8n, automation panels, management interfaces — if they are on the internet, unpatched and unauthenticated, they are exactly the door being sought. Do not expose them; if you must, put them behind authentication and a VPN.
• Patching matters just as much. The confirmed compromises (NetScaler) came from known CVEs. A patching program and a periodic audit of what you expose to the internet remain the baseline defense — security testing exists precisely to find the door before an attacker does.