Hacker Uses DeepSeek AI to Autonomously Attack Vulnerable Servers

First Documented Autonomous AI Attack Campaign

Palo Alto Networks Unit 42 has published research exposing the first comprehensively documented case of a fully autonomous AI-driven cyberattack campaign — a Chinese-speaking threat actor directing an AI agent via a single Telegram message and letting it operate independently across hundreds of targets.

The operator, identified by aliases "knaithe" and "KnYuan", used the DeepSeek large language model combined with the open-source Hermes Agent framework to autonomously perform target reconnaissance, vulnerability research, exploit selection, and attack execution — with minimal human intervention.

The Attack Stack

The threat actor assembled a novel attack infrastructure from publicly available components:

Hermes Agent supports a "Yolo" mode that executes commands — including potentially destructive ones — without operator confirmation. This mode was used in the observed campaigns.

How the Infrastructure Was Exposed

The campaign came to light through an operational security failure. While responding to a Telegram command, the Hermes Agent spun up an HTTP file server from its home directory (/home/worker) rather than an isolated staging directory — exposing the actor's entire workspace:

• API keys and credentials
• Custom exploit scripts and PoC code
• Target lists with 460+ entries
• Shell command history
• Full AI attack session logs showing DeepSeek's reasoning chain

This unintentional exposure gave Unit 42 an unusually detailed window into the threat actor's methodology and targets.

CVEs Targeted

The autonomous campaign targeted seven vulnerabilities across widely deployed software:

Patch Status

DeepSeek's Autonomous Reasoning in Action

Unit 42's exposure of the workspace included AI session logs that reveal how DeepSeek reasoned through the attack chain. In a documented May 2026 session targeting Langflow:

1. DeepSeek pulled a public PoC for CVE-2026-33017
2. Used FOFA to enumerate 84 Langflow instances
3. Found one running v1.3.4 (vulnerable version)
4. Exploitation failed — instance had auto_login disabled and no public flow ID
5. DeepSeek autonomously pivoted:
   - Surveyed 10 product families by exposed instance count on FOFA
   - Searched GitHub for trending 2026 CVE PoC repos (sorted by stars)
   - Selected n8n: 647,000+ exposed instances vs. Langflow's 84
6. Switched to CVE-2026-21858 targeting

This pivot — from one failed target to a higher-value target, using GitHub trending data as a signal — was performed entirely by the AI without human input.

Multi-LLM Testing

The threat actor systematically evaluated multiple AI models for offensive capability, testing alongside DeepSeek:

• Chinese models: Qwen, GLM, Kimi, MiniMax
• Western models: Limited trials of Claude Code and OpenAI Codex

This indicates the actor is conducting systematic AI capability benchmarking for offensive operations — selecting the best model for each attack phase rather than committing to a single tool.

Autonomous AI vs. Manual Operations

An important nuance in Unit 42's findings: the autonomous AI-directed attacks did not successfully compromise their targets in the observed sessions. However, the same threat actor ran parallel manual operations that did achieve confirmed compromises:

The AI represents a capability multiplier and force multiplier — enabling one operator to scan and attempt exploitation across hundreds of targets simultaneously — but human-directed exploitation remains more reliable when it encounters defensive controls or misconfigurations.

What This Means for Defenders

This campaign represents a qualitative shift in the threat landscape:

1. Scale without expertise: An AI agent can enumerate hundreds of targets and research CVEs faster than a human team, lowering the skill bar for broad exploitation campaigns
2. Adaptive targeting: The autonomous pivot from Langflow to n8n — selecting targets by exposed instance count — is a type of target prioritization previously requiring experienced analysts
3. Detection gap: Traditional IOC-based detection may not catch AI-driven attacks that adapt their approach in real time
4. Internet-exposed services are high priority: FOFA enumeration means any internet-exposed service running a known-vulnerable version is a target

Immediate Priorities

• Patch Langflow to v1.9.0+, n8n to v1.121.1+ if internet-exposed
• Remove internet exposure from n8n, Langflow, Marimo, and other AI infrastructure where not operationally required
• Implement network segmentation between AI/automation tooling and production data
• Monitor for FOFA-pattern scanning behaviour in web application logs (high-volume, low-payload GET requests with tool-like User-Agent strings)

Sources

• Hacker Uses DeepSeek AI to Autonomously Attack Vulnerable Servers — BleepingComputer
• Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks — Palo Alto Unit 42
• Chinese Hacker Commands DeepSeek via Telegram — The Hacker News

Related Reading

• ESET H1 2026: Malicious AI Skills Surge to 3,000+
• CISA Flags Actively Exploited n8n RCE Bug
• Critical n8n Flaws Allow Remote Code Execution and Exposure of Stored Credentials