A DeepSeek Agent Hit 460 Targets. Login Screens Won.

TL;DR

Palo Alto Networks' Unit 42 published a teardown of a real, running attack operation in which a Zhuhai-based researcher going by knaithe (also KnYuan) wired DeepSeek into the open-source Hermes Agent framework and drove it over Telegram to attack more than 460 internet-facing systems. The model ran the whole loop on its own: enumerate targets, read CVEs, pick one, write and run the exploit, then move on. The punchline is how badly it did. Across 460-plus tries, Unit 42 confirms three data exfiltrations from Citrix NetScaler and remote code execution on eleven Marimo notebooks. Almost everything else died at a login form. And the operator got caught because his own agent left an HTTP file server open in its home directory.

What actually got wired together

Strip the "AI cyberattack" headline and the architecture is boringly familiar to anyone who builds agents. Hermes Agent is a provider-agnostic framework from Nous Research: it runs in a terminal, it does tool calling against any model, and it saves reusable procedures as loadable "skills." knaithe pointed it at DeepSeek as the reasoning brain, ran it in autonomous "Yolo" mode, and issued orders through a Telegram channel so he never had to babysit a session.

Then he handed it the sharp tools. The recovered environment included custom skills named godmode (an LLM jailbreak), web-terminal-exploitation, and fofa-cyberspace-search, plus a homemade fofoapi.py and an MCP server that translated plain English into FOFA scan queries. The actor also maintains a public vuln-intel pipeline called 1DayNews that scrapes RCE disclosures from 17 sources and uses DeepSeek to filter them for exploitability. In other words: a stocked armory, an agent that never sleeps, and a model with no built-in safety layer to say no. Think of it as handing a very fast, very literal intern root access, a folder of exploits, and a phone number, then texting it targets from the couch.

The autonomous loop, and where it broke

Unit 42 recovered a full session from May 7, 2026, and it reads less like a Hollywood breach and more like a junior pentester having a rough afternoon. The agent pulled a Langflow proof-of-concept off GitHub, enumerated 84 live instances via FOFA, found exactly one candidate, and bounced. Its own note: "All three Langflow need public flow ID but no auto_login - stuck. Deployments small (84 alive), exploitable probably 0. Search for larger-scale vulns."

So it went shopping for a bigger target and landed on n8n, cheerfully reporting "The n8n one with 258 stars and CVSS 10.0 looks extremely promising!" It counted 647,017 exposed n8n instances worldwide, 25,209 of them in China, downloaded the exploit chain, tried three vulnerable versions, and then read the code more carefully: "Actually, looking at the exploit code again - it needs an UNAUTHENTICATED form with file upload. These forms have auth enabled." All of them, apparently. The perfect 10.0 CVSS was useless without an unlocked door.

That pattern repeated across the campaign. The operator staged seven CVEs in total, but only two product families actually fell.

What it did land

The wins were real, and worth taking seriously even at a tiny hit rate. The agent exploited Citrix NetScaler via CVE-2026-3055 and exfiltrated memory from three victims, and it landed remote code execution on eleven Marimo notebook instances through CVE-2026-39987. Unit 42 also flags persistent, multi-day targeting of a Malaysian government entity, with the operator adding proxy anonymization on later attempts once things got serious.

So the scary number and the reassuring number are the same story. A single motivated operator got an autonomous agent to run a real, multi-target offensive campaign end to end, which is the part that should keep defenders up at night. And that agent still spent most of its time face-planting into authentication it had no plan for, which is the part that says the tooling is not magic yet.

The part builders should sit with

Here is the detail that matters more than any CVE. knaithe had several models wired into the same rig, including Claude Code (behind a proxy) and OpenAI's Codex. He barely used them. Unit 42's colleagues at OpenAI confirmed that provider-side safeguards refused requests that violated policy and that their safety systems flagged and disabled an account believed linked to the campaign. The daily driver ended up being DeepSeek precisely because, as the report puts it, the framework had "no built-in safety layer," paired here with a godmode jailbreak skill for good measure.

This is the open-weights safety argument, live, with a body count of exactly zero heroic hackers and a lot of shell scripts. The same week a Microsoft-led letter argued open weights make everyone safer through scrutiny, and Anthropic argued the opposite, this campaign is the closest thing to a controlled experiment: point the same operator at hosted models and unrestricted ones, and watch which one actually pulls the trigger. The hosted providers refused and killed the account; the no-guardrails model ran the play. That does not settle the debate, but it is a real data point instead of a hypothetical.

How they got caught

The ending is almost too on the nose. Unit 42 got the entire environment (API keys, exploit scripts, target lists, bash history, and full Hermes session logs) because the agent, at some point, started an HTTP file server in its own home directory at /home/worker and left it exposed to the internet. The autonomous hacking rig that spent weeks hunting other people's unauthenticated services got owned by publishing its own. If you build agents that can run arbitrary commands, that is the failure mode in a nutshell: the tool does exactly what it is told, including the parts you did not think to forbid.

Key Takeaways

• Autonomous offense is real but clumsy. One operator ran an end-to-end recon-to-exploit campaign against 460-plus targets, and confirmed impact was three Citrix NetScaler exfils and eleven Marimo RCEs. High severity on paper, low landing rate in practice.
• Auth is still the wall. The agent kept selecting CVSS 9.8 and 10.0 bugs, then discovering they needed an unauthenticated endpoint it did not have. Perfect scores, locked doors.
• Model choice was the safety layer. Hosted providers refused and disabled an account; the operator fell back to DeepSeek specifically because it shipped no guardrails, plus a jailbreak skill.
• The framework was ordinary. Nous Research's Hermes Agent, Telegram for command and control, FOFA over MCP. Nothing here required a nation-state, just off-the-shelf agent plumbing.
• Agents leak themselves. The operation was exposed because the agent served its own working directory over HTTP. Arbitrary command execution cuts both ways.

Sources: Unit 42 (Palo Alto Networks), BleepingComputer, The Hacker News, GBHackers