Chinese Actor Weaponizes DeepSeek AI Agent to Attack Security Firm

The scenario that threat researchers have been warning about for years has now materialized in the wild. Palo Alto Networks' Unit 42 published research documenting the first confirmed autonomous AI-driven cyberattack campaign — carried out by a Chinese-speaking threat actor who wired DeepSeek into the open-source Hermes Agent framework and directed the whole operation via Telegram, with no persistent human involvement required during attack execution.

How the Campaign Was Discovered

The threat actor, operating under the aliases "knaithe" and "KnYuan" and assessed as based in Zhuhai, China, made a critical operational security mistake: the Hermes Agent accidentally created a web server from its home directory, exposing the attacker's full working environment to the internet — including API keys, target lists, exploit scripts, shell history, and AI session logs. This OPSEC failure handed Unit 42 a rare, near-complete picture of how a live AI-driven attack campaign operates end-to-end.

The actor is assessed as an independent opportunistic operator, not a state-sponsored entity — their GitHub profile describes them as a binary security researcher. The campaign's goal was proxyjacking: compromising hosts to use as proxy nodes for launching further downstream attacks.

The Attack Architecture

The technical setup was straightforward and replicable by actors with modest resources:

• DeepSeek (Chinese open-source LLM) served as the reasoning engine
• Hermes Agent (open-source agentic framework) provided the autonomous execution layer
• Telegram served as the command-and-control interface — the operator sends a message, the agent executes
• FOFA (a Shodan-equivalent search engine popular in China) was used for target enumeration
• GitHub was mined for public proof-of-concept exploit code

The AI agent autonomously performed vulnerability enumeration, sourced PoC exploits, selected targets, and attempted exploitation — all without requiring the operator to be present. DeepSeek was supplemented by Qwen, GLM, Kimi, and MiniMax for various tasks. Claude Code and OpenAI Codex appeared only in connectivity tests and exploit development artifacts.

The Exploit Portfolio: 8 CVEs Across 7 Attack Tracks

Unit 42 documented eight CVEs across seven exploit tracks:

The agent attempted exploitation against approximately 460 hosts across these product families. Against Langflow (CVE-2026-33017), DeepSeek autonomously enumerated 84 instances but failed because the targeted instances lacked the required configuration. The agent then pivoted autonomously — surveying 10 product families and selecting n8n as a higher-value target, chaining an arbitrary file read (CVSS 10.0) with a sandbox bypass to RCE (CVSS 9.9) across 647,000+ exposed instances. Authentication requirements on exposed endpoints blocked the bulk of these attempts.

Confirmed Compromises

Three organizations were confirmed compromised via CVE-2026-3055 (Citrix NetScaler memory overread, affecting appliances configured as SAML identity providers), enabling session hijacking via stolen authentication cookies. A Malaysian government entity is among the suspected victims. Additionally, command execution was confirmed on 11 Marimo notebook instances via CVE-2026-39987.

Jesta Security: The Trap

The attack on a cybersecurity firm was intentional. Tel Aviv-based Jesta Security set a trap, intercepted the attacking AI agent, and took control of it. Jesta's CEO Aviv Halfon stated: "A human threat actor with malicious intent deliberately weaponized an AI model to run an agentic attack campaign end to end."

The agent was attempting to compromise over 1,200 hosts for proxyjacking when Jesta intercepted it — turning the attacker's autonomous system against itself and producing some of the clearest forensic evidence of how the campaign operated.

What This Means for Defenders

The "knaithe" campaign is a watershed moment. It confirms that:

1. Agentic AI attacks are no longer theoretical — they are occurring in production environments, today, using commodity open-source tools
2. Low-sophistication actors can leverage AI to dramatically amplify their reach — Telegram as C2, public LLMs, open-source exploit repos: the barrier to entry is lower than ever
3. Unpatched known vulnerabilities are the primary attack surface — every CVE in this campaign had a patch available before exploitation was attempted
4. OPSEC failures remain the defender's best friend — the campaign was exposed not by detection but by the attacker's own mistake

Immediate actions for security teams:

• Patch CVE-2026-3055 (NetScaler), CVE-2026-33017 (Langflow), CVE-2026-21858 + CVE-2025-68613 (n8n) — all actively exploited; NetScaler and Langflow are on CISA KEV
• Audit exposure of n8n, Langflow, Marimo, and Apache Tomcat instances — check FOFA/Shodan for your own footprint
• Restrict internet exposure of internal automation tools (n8n, Jupyter/Marimo) — these are high-value targets with large known-vulnerability surfaces
• Monitor for Telegram-based C2 traffic patterns in network egress — unusual long-polling connections to Telegram API endpoints may indicate compromised infrastructure being used as an agent relay
• Hunt for proxyjacking indicators — unexpected egress to proxy networks, unusual outbound connection volume, or new processes opening listening ports on compromised hosts

The age of autonomous AI cyberattacks has arrived. The "knaithe" campaign will not be the last.