Artificial intelligence is rapidly transforming the cyber threat landscape. Researchers have uncovered a campaign in which a threat actor leveraged DeepSeek AI together with the Hermes Agent framework to autonomously identify, evaluate, and attempt to exploit vulnerable internet-facing servers with minimal human intervention.
AI Agent Conducted Autonomous Vulnerability Research
The campaign was discovered by researchers at Palo Alto Networks Unit 42 after a misconfigured Hermes environment accidentally exposed the attacker’s infrastructure, revealing exploit scripts, API keys, attack logs, shell history, and target lists.
The investigation attributed the activity to a Chinese-speaking threat actor operating under the aliases “knaithe” and “KnYuan.” Although the observed attacks did not successfully compromise the intended targets, the campaign demonstrates a fully functional AI-driven offensive workflow capable of performing complex attack operations with very limited operator input.
DeepSeek Powered the Decision-Making Process
At the core of the operation was DeepSeek, which served as the reasoning engine for Hermes Agent—an open-source AI framework capable of executing terminal commands, interacting with external services, and accessing online resources.
Configured in its unattended “YOLO” mode, Hermes was able to execute commands without requesting confirmation from its operator. The framework also integrated with:
- Telegram for receiving task instructions.
- FOFA internet asset search engine for target discovery.
- Custom offensive security modules for vulnerability research and exploitation.
Researchers recovered an attack session showing that the operator issued only an initial objective before the AI agent independently handled the remaining stages of the operation.
Autonomous Target Discovery and Exploit Selection
The AI agent initially searched for internet-exposed Langflow servers vulnerable to CVE-2026-33017.
Its workflow included:
- Downloading a public proof-of-concept exploit.
- Identifying exposed Langflow instances through FOFA.
- Scanning discovered systems for vulnerable configurations.
When exploitation attempts proved unsuccessful, the agent autonomously reassessed the situation instead of repeatedly executing the same attack.
It analyzed publicly available exploit repositories, evaluated alternative vulnerabilities, and ultimately selected the n8n workflow automation platform as a more promising target based on its significantly larger internet exposure.
The agent then downloaded a public exploit chain targeting CVE-2026-21858 and CVE-2025-68613, identified potentially vulnerable deployments, and searched for unauthenticated file-upload endpoints required to complete exploitation.
Although authentication controls ultimately prevented compromise, the AI demonstrated the ability to independently perform vulnerability research, exploit selection, and target prioritization.
AI Reduced Hours of Manual Reconnaissance to Minutes
According to Unit 42, one of the most significant findings was not the failed exploitation attempts, but the speed at which the AI agent completed tasks traditionally performed by experienced penetration testers or threat actors.
Within minutes, the system:
- Collected intelligence on exposed infrastructure.
- Evaluated multiple vulnerability candidates.
- Ranked targets by exploitability.
- Downloaded appropriate proof-of-concept exploits.
- Validated attack prerequisites.
- Shifted strategies when initial exploitation failed.
This level of autonomous decision-making represents a major evolution in AI-assisted offensive security.
Manual Attacks Still Played a Role
While DeepSeek automated much of the reconnaissance and exploitation workflow, researchers also observed the operator conducting manual attacks against hundreds of additional systems.
Those operations targeted vulnerabilities affecting technologies including:
- Citrix NetScaler
- Apache Tomcat
- Marimo Notebook
- Windows IKE VPN
- Other enterprise-facing services
Researchers confirmed successful compromises involving CVE-2026-3055 in Citrix NetScaler, where memory extraction techniques were used to search for authentication cookies capable of enabling session hijacking.
Growing Risks of Autonomous AI in Cybersecurity
The investigation also revealed that the attacker had configured several additional AI coding platforms—including Qwen, GLM, Kimi, MiniMax, Claude Code, and OpenAI Codex—although DeepSeek remained the primary engine for autonomous operations.
This campaign highlights a significant shift in offensive cybersecurity. Rather than simply generating exploit code, modern AI agents are becoming capable of independently conducting reconnaissance, selecting attack paths, adapting to failed attempts, and managing complex intrusion workflows with minimal human oversight.
For defenders, the findings reinforce the importance of rapidly patching internet-facing systems, minimizing exposed services, enforcing strong authentication, continuously monitoring for unusual reconnaissance activity, and implementing behavioral detection capable of identifying AI-driven attack patterns before they progress to successful compromise.
Leave a Reply