The AI Wrote the To-Do List: Unit 42 on BUGSTER’s Hermes Agent and Jailbroken DeepSeek Crime Spree

2026-10-21 Agent & Supply Chain Security by al-ice.ai Editorial

“Can you find about like what scam or thing they done in past like spoofing calls or somthing [sic],” the threat actor typed. The conversation was with one of several AI assistants the actor was using for advice on planning and executing cybercrime — and one of those assistants helpfully generated a document that included a section titled “NEXT EXPLOIT OPPORTUNITIES”, outlining follow-up attacks. When the AI writes the criminal’s to-do list, the line between tool and accomplice has moved, and Unit 42’s report of 21 October 2026 is the clearest field evidence yet of where it now sits. We read the report first-hand.

Unit 42 investigated the operational environment of an actor working under the handle BUGSTER and found the AI assistant weaponised across five distinct crime types: credential theft and data exfiltration, VoIP telecommunications fraud, Wi-Fi password cracking, cryptocurrency reconnaissance, and command-and-control operations. The toolchain: the Hermes Agent framework with DeepSeek V4 as its reasoning engine and Cursor as a secondary tool, both with safety controls disabled. The jailbreak, in Unit 42’s assessment, was a simple system-prompt override — not a novel attack on the model, just the front door left ajar.

Low skill, real impact

The report’s central judgment deserves quoting in structure if not in words: the attacker used basic tooling and relied on AI-generated scripts and reconnaissance reports, suggesting they lacked the skills these activities would previously have required — and despite visible bumbling, they had impact. An AI-generated brute-force campaign ran against an Indian university’s website. A confirmed intrusion at a second university exfiltrated a database of more than 5,200 records including students’ personally identifiable information. The actor mapped multiple organisations’ attack surfaces, built specialised AI bot profiles to acquire VoIP-fraud expertise through conversation, and maintained automated pipelines for Wi-Fi password cracking and for reconnoitring large cryptocurrency holders.

One detail grounds the story: the Wi-Fi cracking capability requires close physical proximity to the target, indicating the actor had local access to the targeted locations. This is not a remote-only operator running scans from another continent; the AI toolchain is being driven by someone with feet on the ground near Indian universities, folding physical proximity into an otherwise automated pipeline. The targets Unit 42 names are in India, including the universities — a reminder that the AI-crime wave is not concentrated on Western enterprises and that victim geography follows the attacker’s own.

A toolchain converging, not a lone actor

The finding with the longest tail is not what BUGSTER did but that BUGSTER is not alone: multiple unrelated actors are independently adopting the same Hermes-plus-DeepSeek combination, and Unit 42 says we may be watching an emerging toolchain of choice for AI-enabled cybercrime. The assessed driver is disarmingly economic — low safety friction at low cost: DeepSeek models are inexpensive, easy to access, and readily jailbroken. When the capable model is cheap and the safety bypass is a prompt override, the barrier to agentic cybercrime is not talent or infrastructure but curiosity.

Place this next to the Cairn investigation into an agent army behind 100+ breaches at roughly $50 and 23 hours per intrusion, built on DeepSeek plus Claude Code, and a pattern sharpens: different actors, different frameworks, same economics. The Cairn toolchain leaned on a frontier Western model alongside DeepSeek; BUGSTER leans on Hermes Agent with Cursor in the loop. Both demonstrate that the agentic-attack pipeline is commoditising from several directions at once, and neither required the attacker to be particularly good — one campaign’s own reporting emphasised bumbling alongside impact. Defences calibrated to skilled human operators, with dwell times and working hours and toolmarks, are measuring the wrong adversary. The current adversary types broken English into a jailbroken assistant and runs what comes back.

What this means for defenders of agent infrastructure

Your users’ AI assistants are dual-use, and the misuse looks like normal usage. Step-by-step VoIP-fraud setup advice requested conversationally is hard to distinguish from legitimate telephony engineering questions at the prompt level. Controls that depend on recognising malicious intent in a single prompt will miss campaigns that distribute intent across dozens of individually innocent questions.
Watch for the framework, not just the model. The policy conversation fixates on which model was abused; Unit 42’s evidence says the operational choice that matters is the agent framework plus the tooling around it. Hermes Agent with IDE integration and disabled safeties is a capability stack, and detection content should target harness behaviours — automated brute-force loops, bulk reconnaissance pipelines, C2-shaped traffic — rather than model identity.
Universities and regional institutions are in the blast radius now. Attack-surface mapping plus AI-generated brute force is a combination that punishes exactly the estate universities run: sprawling, historic, under-staffed. If your sector has those properties, the BUGSTER playbook ports directly to you.
Proximity still matters. The Wi-Fi-cracking thread is the counterweight to the “AI attacks from anywhere” narrative: some capabilities in these pipelines require physical presence. Site-physical security and wireless monitoring belong in the same incident review as the log analysis.

There is a through-line to our earlier briefing on Unit 42’s mapping of Web3 command-and-control, where malware moved C2 lookup onto public blockchains: in both cases the decisive layer is the scaffolding around the payload — the harness that turns a model into an operator, or the lookup that turns a package into a foothold. Models get the headlines; harnesses get the results. BUGSTER’s results were 5,200 stolen records and a to-do list written by the accomplice.

Our verification was read-only. The BUGSTER handle, the Hermes Agent plus DeepSeek V4 plus Cursor toolchain with disabled safety controls, the five crime types, the system-prompt-override jailbreak assessment, the Indian-university brute-force campaign and confirmed 5,200-plus-record exfiltration including student PII, the attack-surface mapping, the VoIP-fraud bot profiles, the automated Wi-Fi and crypto pipelines, the physical-proximity inference, the “NEXT EXPLOIT OPPORTUNITIES” document section, the convergence of unrelated actors on the same toolchain and the low-cost low-friction driver were all read first-hand from Unit 42’s 21 October 2026 report. The Cairn campaign figures are from our own earlier briefing, linked above. No actor infrastructure was accessed, no AI system was prompted, and no victim data is reproduced. Brave Search was used for discovery only.

Sources: