Palo Alto Networks' Unit 42 threat intelligence team has published research documenting what may be the first confirmed case of a threat actor using an AI agent framework to conduct fully autonomous cyberattacks — requiring only a single natural language instruction via Telegram to initiate an end-to-end attack chain.
The Operation
The threat actor, assessed by Unit 42 as Chinese-speaking based on linguistic artifacts and tooling, used the open-source Hermes Agent framework — a publicly available agentic AI orchestration library — to connect DeepSeek to an automated attack pipeline. The workflow required minimal human involvement beyond the initial command.
Attack chain:
1. Attacker sends natural language command via Telegram
Example: "Find vulnerable web servers and exploit them"
2. Hermes Agent receives command, instructs DeepSeek to plan the attack
3. DeepSeek autonomously:
→ Queries internet-facing systems via search APIs and scanning tools
→ Identifies potentially vulnerable targets
→ Retrieves public exploit code for identified vulnerabilities
→ Selects the most promising exploit for each target
→ Stages exploitation attempts
4. Results returned to attacker via TelegramUnit 42 researchers noted they were unable to recover further artifacts confirming successful exploitation, but the documented capability demonstrates that the architecture for autonomous AI-driven attacks is operational in the wild.
Why This Matters
AI Reduces the Skill Floor for Attacks
Traditionally, conducting a reconnaissance-to-exploitation attack chain required meaningful technical skill: knowledge of scanning tools, vulnerability databases, exploit frameworks, and the judgment to select appropriate techniques for specific targets. The Hermes Agent + DeepSeek configuration offloads most of this to the AI model.
An attacker with basic Telegram and API access can now initiate attack chains that would previously have required a competent pentester.
Agentic AI Changes the Threat Timeline
Human-in-the-loop attacks are constrained by human availability and decision speed. Agentic AI attacks are not. A single Telegram message can trigger:
- Simultaneous reconnaissance against multiple targets
- Parallel exploit selection and staging
- Round-the-clock operation without attacker presence
This compresses attack timelines from days or hours to minutes and removes the human bottleneck that defenders have historically been able to exploit (overnight response windows, attacker fatigue, need for command-and-control check-ins).
DeepSeek's Role
DeepSeek — the Chinese-developed large language model that attracted significant attention for its cost-effective performance benchmarks — is notable in this context because:
- It is open-source and can be run locally, eliminating API logging and provider-side safety filters
- Its capabilities are competitive with frontier models for code generation and reasoning tasks
- Local deployment means no API keys to burn or accounts to identify the attacker
The Hermes Agent framework is also open-source, meaning the complete attack pipeline can be assembled from public components with no bespoke infrastructure required.
Hermes Agent Framework
Hermes Agent is an open-source agentic AI framework that provides:
- Tool integration (web search, code execution, API calls, file I/O)
- Multi-step reasoning and planning via LLM backends
- Messaging platform connectors (Telegram, Discord, Slack)
- Plugin architecture for custom tool integration
Its intended use is productivity automation and research. The same architecture that makes it a capable productivity agent makes it a capable attack orchestrator when pointed at offensive tools.
Implications for Defenders
What Changes
| Traditional Attack | AI-Autonomous Attack |
|---|---|
| Human attacker works business hours | Operates 24/7 without rest |
| Manual reconnaissance per target | Simultaneous multi-target recon |
| Skill required for exploit selection | AI selects from public CVE databases |
| C2 check-ins needed | Fully autonomous between command and result |
| Single attacker = single throughput | Single command = parallel execution |
Detection Considerations
The attack's autonomy also creates detection opportunities:
- Scanning signatures: Automated reconnaissance generates high-volume, systematic scanning patterns distinct from human-paced browsing
- Exploit staging anomalies: AI-selected exploits may be suboptimal for specific targets, generating noisy or failed exploit attempts that trigger IDS/IPS signatures
- API query patterns: Threat intelligence API lookups (Shodan, Censys, CVE databases) at volume from single sources can indicate automated tooling
Organizational Response
Threat model update: The assumption that attackers are constrained by human capacity is no longer valid for adversaries deploying agentic AI. Attack surface management must now account for continuous, automated discovery rather than periodic manual reconnaissance.
Patch velocity: The window between vulnerability disclosure and exploitation is shrinking as AI agents can immediately query for newly published CVEs and stage exploitation. Patch SLAs for critical vulnerabilities should be measured in hours, not days.
Monitoring for agentic indicators: Train security teams and SIEM rules to recognize the behavioral signatures of automated attack tooling — high-rate, systematic, and temporally consistent activity patterns that differ from human attacker cadence.
The Broader AI-Offensive Landscape
Unit 42's research is consistent with a trend documented across the security research community in 2026: AI models are being integrated into offensive security tooling at an accelerating rate. Previous documented cases include:
- AI-assisted phishing email generation at scale
- LLM-powered malware variant generation
- AI-driven social engineering and pretexting
- Automated vulnerability discovery in source code
The Hermes Agent + DeepSeek case represents a maturation of this trend: rather than AI assisting a human attacker, the AI is directing the attack with the human reduced to a single-command initiator.