Chinese Threat Actor Wires DeepSeek Into Hermes Agent for Autonomous Mass-Exploitation Campaign (460+ Targets)

Palo Alto Networks Unit 42 disclosed (July 30, 2026, heavily covered/discussed across security media on Aug 1-2, 2026) the first publicly documented end-to-end autonomous offensive AI operation: a single Telegram instruction triggered an agentic framework (Hermes Agent + DeepSeek) to independently scan, select, and exploit vulnerable internet-facing AI/dev-tooling infrastructure across three countries, compressing what the researchers describe as hundreds of hours of manual targeting into minutes. The actor also tested Claude Code and OpenAI Codex but reported that safety guardrails blocked offensive use on those platforms, leaving DeepSeek's unrestricted access as the functional attack engine.

This is a concrete, real-world proof that agentic AI frameworks combined with permissive open-weight models can autonomously conduct multi-target cyberattacks with minimal human oversight — collapsing the skill and time barrier for mass exploitation. It demonstrates that model-level safety refusals (present in Claude/OpenAI) function as a measurable defensive control, while open frameworks with no client-side restrictions can be weaponized wholesale. Any AI-agent framework (Hermes, LangChain, AutoGen, etc.) wired to a permissive LLM and given command-channel + tool access constitutes a novel, low-barrier attack platform.

A Chinese-speaking threat actor (aliases knaithe/KnYuan) wired the DeepSeek model into the open-source Hermes Agent framework as an autonomous reasoning/execution engine, controlled via a single Telegram command with no further human intervention ("Yolo mode", no approval gating). The agent autonomously enumerated 460+ internet-exposed targets via FOFA, sourced PoC exploits from GitHub, prioritized CVEs by severity/prevalence, and launched exploitation attempts end-to-end. Confirmed impacts: data exfiltration from 3 orgs via Citrix NetScaler (CVE-2026-3055) and command execution on 11 Marimo instances (CVE-2026-39987); autonomous attempts against Langflow (CVE-2026-33017) and n8n (CVE-2026-21858 + CVE-2025-68613) failed due to target hardening. The operator's own misconfigured HTTP file server leaked the full toolchain, giving Unit 42 forensic visibility.

Hermes Agent (NousResearch open-source agentic framework) + DeepSeek models; downstream victims running Langflow, n8n, Citrix NetScaler ADC/Gateway, Marimo Notebook

Patch Langflow to 1.9.0+, n8n to 1.121.1+ (or 1.121.0+1.120.4/1.122.0), Marimo to 0.23.0+, and apply Citrix NetScaler ADC/Gateway builds per vendor bulletin; verify SAML IdP config (remove/patch `add authentication samlIdPProfile`). Organizations should also treat AI-agent Telegram/command-channel bridges as a monitored attack surface and audit exposed workflow/notebook platforms for public accessibility.