{"data":{"id":2119,"lang":"en","title":"Chinese Hacker Used DeepSeek AI to Autonomously Attack Over 460 Servers","summary":"A Chinese hacker weaponized DeepSeek AI via the open-source Hermes Agent framework to autonomously attack over 460 servers, Unit 42 researchers found.","category":"ai","category_label":"AI","published_at":"2026-08-02T18:01:50Z","updated_at":"2026-08-02T18:01:50Z","url":"https://techtools.cz/tools/news/article/2119-chinese-hacker-used-deepseek-ai-to-autonomously-attack-over-460-servers","api_url":"https://techtools.cz/news-api/v1/articles/2119?lang=en","markdown_url":"https://techtools.cz/news-api/v1/articles/2119.md?lang=en","image_url":"https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi2dGysHIR6yJWx6hMxq6lAct7fi4YTury_WDkrcenDv-psd-fU7I8K3RbM6Blox_5OE3MQojew5bnPamtI_DPzdBX6fOk295hhQh6rBkA2f9a1sN7t7ZbSyU-kWdLoIb7XnseOHKPmLOGRb9wRRvmV0scVZ4rhMtxSmqOLZmZIUjtg_IHT4FBg5gzeX50/s1700-e365/deepseek-telegram.jpg","word_count":157,"reading_time_minutes":1,"sources":[{"url":"https://thehackernews.com/2026/07/chinese-hacker-commands-deepseek-via.html","domain":"thehackernews.com"},{"url":"https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign/","domain":"unit42.paloaltonetworks.com"}],"translation":{"lang":"cs","id":2192,"title":"Čínský hacker použil AI model DeepSeek k autonomním útokům na více než 460 serverů","url":"https://techtools.cz/tools/news/clanek/2192-cinsky-hacker-pouzil-ai-model-deepseek-k-autonomnim-utokum-na-vice-nez-460","api_url":"https://techtools.cz/news-api/v1/articles/2192?lang=cs"},"content":"Palo Alto Networks' Unit 42 uncovered a Zhuhai-based threat actor, tracked as \"knaithe\" and \"KnYuan,\" who turned the DeepSeek AI model into an autonomous cyberattack operator. Using the open-source Hermes Agent framework and simple Telegram commands, the hacker let DeepSeek independently scan for exposed servers, select exploits, and decide which systems to target next with minimal human oversight.\n\nThe campaign launched exploitation attempts against more than 460 internet-facing systems, including 84 Langflow instances and over 25,000 exposed n8n systems detected in China alone. Unit 42 confirmed three successful data-exfiltration breaches via the Citrix NetScaler flaw CVE-2026-3055, alongside attempted intrusions on Marimo notebooks, Apache Tomcat servers, and VPN endpoints.\n\nResearchers discovered the operation after Hermes Agent accidentally exposed a web server from its own home directory, revealing API keys, exploit scripts, and attack logs. Notably, DeepSeek carried out offensive tasks that Claude and OpenAI's models had refused, underscoring growing concerns about inconsistent safety guardrails across AI providers."}}