Palo Alto Networks' Unit 42 uncovered a Zhuhai-based threat actor, tracked as "knaithe" and "KnYuan," who turned the DeepSeek AI model into an autonomous cyberattack operator. Using the open-source Hermes Agent framework and simple Telegram commands, the hacker let DeepSeek independently scan for exposed servers, select exploits, and decide which systems to target next with minimal human oversight.
The campaign launched exploitation attempts against more than 460 internet-facing systems, including 84 Langflow instances and over 25,000 exposed n8n systems detected in China alone. Unit 42 confirmed three successful data-exfiltration breaches via the Citrix NetScaler flaw CVE-2026-3055, alongside attempted intrusions on Marimo notebooks, Apache Tomcat servers, and VPN endpoints.
Researchers discovered the operation after Hermes Agent accidentally exposed a web server from its own home directory, revealing API keys, exploit scripts, and attack logs. Notably, DeepSeek carried out offensive tasks that Claude and OpenAI's models had refused, underscoring growing concerns about inconsistent safety guardrails across AI providers.