A DeepSeek-Powered Agent Ran a Live Exploit Cycle—Then Exposed Its Operator
Palo Alto Networks Unit 42 says it recovered evidence of a Chinese-speaking threat actor using DeepSeek through the open-source Hermes Agent framework to run a live, end-to-end offensive workflow. From one initial task, the agent enumerated exposed services, tested a Langflow exploit, abandoned that target class when prerequisites were absent, researched more promising vulnerabilities, downloaded public proof-of-concept code, and launched a second round of attacks against n8n servers.
The autonomous attempts Unit 42 could reconstruct did not produce a confirmed compromise. Authentication and deployment configuration stopped the observed Langflow and n8n chains. The same actor separately achieved confirmed impact through manual campaigns, including data exfiltration from three Citrix NetScaler targets and command execution on 11 Marimo notebook endpoints. Keeping those outcomes separate matters: this is strong evidence that a threat actor operationalized an autonomous attack loop, not evidence that the loop itself successfully breached the reported victims.
The July 30 report is unusually valuable because it is based on recovered infrastructure rather than a survey or controlled benchmark. The agent accidentally started an HTTP server from the operator’s home directory, exposing API keys, target lists, exploit scripts, shell history, tool configurations, and autonomous session logs. The offensive system became the source of its own forensic record.
From a Telegram task to autonomous retargeting
Unit 42 attributes the operation to an actor using the aliases knaithe and KnYuan. The primary attack stack paired DeepSeek as the reasoning engine with Hermes Agent for terminal access, Telegram orchestration, persistent skills, and tool execution. The operator added custom procedures for FOFA internet-asset discovery and WebSocket exploitation, and integrated an MCP server that exposed FOFA searches, Nuclei scan generation, and natural-language query translation.
In the recovered May 7 session, the system first selected CVE-2026-33017, a critical Langflow remote-code-execution vulnerability. NVD describes the issue as affecting Langflow before 1.9.0: an unauthenticated endpoint for building public flows could accept attacker-controlled node definitions and execute embedded Python without sandboxing. The agent downloaded public exploit code, used FOFA to enumerate 84 Langflow instances, ran a threaded scanner, and found one target running Langflow 1.3.4.
That path failed because the required public-flow or automatic-login condition was not available. The important behavior came next. Instead of waiting for another operator command, the agent judged the target class low value, surveyed deployment counts across 10 product families, searched GitHub for popular 2026 CVE proofs of concept, ranked candidates by severity, footprint, and apparent exploitability, and pivoted to n8n.
For n8n, it acquired a public chain combining CVE-2026-21858, an unauthenticated file-access flaw fixed in 1.121.0, with CVE-2025-68613, an expression-injection RCE fixed across the affected release lines. It identified three servers running apparently vulnerable versions and found form endpoints on one. Authentication blocked those endpoints, and more than 50 additional targets lacked the publicly accessible forms the exploit required. Unit 42 says the autonomous n8n attempt ended without exploitation.
Autonomy compressed the reconnaissance loop, not the exploit prerequisites
Across autonomous and manual activity, Unit 42 identified attempts against more than 460 targets. In the n8n phase, the agent sampled roughly 100 addresses from a much larger FOFA result set and probed about 40 unique IPs before narrowing the list to three vulnerable versions. That is the operational change defenders should notice: discovery, triage, exploit acquisition, version checking, and retargeting were connected into one reusable workflow.
But the evidence also establishes limits. The agent treated GitHub stars as one signal of exploit promise, needed public proof-of-concept code, and failed when real deployments did not meet exploit assumptions. It could accelerate selection and execution, but it did not invent a path around authentication in the recovered session. Configuration details that would frustrate a conventional scanner frustrated the agent too.
This is therefore neither “fully autonomous hacking has arrived” nor “the agent failed, so nothing changed.” A better reading is that commodity components can now automate the expensive connective tissue between steps. The operator supplied infrastructure, access to models, permissive execution, specialist skills, and a broad objective. The agent supplied persistence across the loop: observe failure, research alternatives, select another attack surface, retrieve tooling, and continue.
The actor built a system, not a single chatbot session
The recovered configuration included several model and coding-agent options. Unit 42 found direct DeepSeek and Qwen access, plus Claude Code and Codex routed through a third-party proxy. The report says Claude Code activity was limited to connectivity and proxy tests, while Codex had been trusted on exploit-development directories but retained no recoverable conversation history. OpenAI told Unit 42 that provider-side safeguards refused policy-violating requests and that an account believed to be linked to the campaign had already been flagged and disabled.
The clearest offensive capability came from the DeepSeek–Hermes pairing, where the actor removed client-side friction and installed reusable red-team skills. This distinction is important for enterprise threat modeling. Model policy is only one layer. A locally controlled harness can provide unrestricted shell access, long-lived memory, scheduled execution, external command channels, specialist procedures, and alternative model providers. Blocking one account or one model does not dismantle the workflow.
The same architecture also created a defensive opening. Responding to a Telegram command, Hermes Agent launched python3 -m http.server 8888 from /home/worker instead of a restricted staging directory. That exposed the operator’s broader workspace despite other attempts to reduce attribution and logging. Autonomous execution amplifies mistakes in both directions: a wrong working directory can leak far more, for far longer, when no human checks the command before it runs.
What defenders should change now
- Patch the reachable products, not the AI headline. Langflow users should be on 1.9.0 or later for CVE-2026-33017. n8n operators should verify that their release fixes CVE-2026-21858 and CVE-2025-68613, then review public forms, workflow permissions, and internet exposure.
- Remove accidental prerequisites. Authentication on the observed n8n forms and the absence of a usable public Langflow flow stopped the reconstructed attacks. Inventory public workflow endpoints, disable anonymous access that is not explicitly required, and place administrative and automation interfaces behind identity-aware controls.
- Detect the loop, not just one payload. Correlate asset-search patterns, version probes, rapid switching between product families, GitHub proof-of-concept downloads, scanner creation, and exploit attempts from the same infrastructure. Agentic campaigns may generate more consistent behavioral sequences than manual operators.
- Rate-limit reconnaissance economics. The agent deliberately sampled targets to conserve compute. Response shaping, rate limits, tarpits, and high-fidelity deception can increase uncertainty and cost while generating early telemetry.
- Hunt for exposed operator infrastructure. Open directory listings, ad hoc Python HTTP servers, API keys in reachable home directories, agent transcript databases, Telegram bot artifacts, and default tool ports can reveal more than the exploit traffic alone.
- Constrain internal agents by architecture. The same stack can exist inside a legitimate organization. Use isolated workers, short-lived credentials, egress allowlists, per-tool authorization, immutable audit logs, bounded working directories, and approval gates for scanning, exploit retrieval, or public-service interaction.
- Separate model identity from campaign attribution. Logs should record the harness, model endpoint, tool calls, credentials, and execution host. A campaign may test several assistants while relying operationally on only one of them.
The campaign complements recent evidence from cyber evaluations that crossed into real infrastructure, but the control problem is different. In evaluation incidents, containment failed around authorized testing. Here, a threat actor intentionally assembled an offensive agent environment and let it operate against internet targets. Both cases reach the same engineering conclusion: long-horizon agents must be governed at the execution, identity, network, and tool layers—not by trusting the model to remain within an intended role.
Unit 42’s strongest finding is the trajectory rather than the damage from this autonomous session. The observed exploit attempts failed, yet the system already performed autonomous target selection and pivoting with off-the-shelf components. Defenders should use the current failure margin to harden exposed services and instrument multi-step behavior before a similar loop encounters the permissive configuration it needs.
Sources: