TLDR
A Chinese-speaking operator sent a single Telegram command and let a DeepSeek-powered agent autonomously scan, select exploits and attack more than 460 targets, the first documented end-to-end autonomous AI attack campaign. Palo Alto Networks' Unit 42 reconstructed the entire workflow after the attacker's own agent accidentally exposed its API keys, exploit scripts and session logs on a public HTTP server. Despite the scale of the operation, only three targets were successfully compromised, with autonomous runs against Langflow and n8n failing because exposed systems lacked the configurations the agent expected. Unit 42 still called the result proof of functional autonomous offensive capability in the wild.
KEY TAKEAWAYS
One command, 460-plus targets, no human in the loop
The attacker's first move was almost invisible: a single message sent over Telegram. What followed was entirely machine-driven. Palo Alto Networks' Unit 42 documented the first known end-to-end autonomous AI attack campaign, carried out by a Chinese-speaking operator who used DeepSeek through the open-source Hermes Agent framework to independently enumerate targets, select exploits and execute attacks without further human input.verifiedVerified Source: unit42.paloaltonetworks.com[1] The operator, tracked under the aliases knaithe and KnYuan, is the only human fingerprint on a campaign that was otherwise run entirely by software.
Unit 42 researchers said the findings demonstrate something the security industry has long theorised about. The Unit 42 research team said their findings document a threat actor developing AI-augmented offensive capabilities that enabled them to dramatically increase the speed and scale of their campaigns.[1]
How Hermes Agent turned DeepSeek into an autonomous attacker
Hermes Agent is an open-source orchestration layer that ties a natural-language reasoning model, in this case DeepSeek, to a set of execution tools. One high-level instruction triggers a sustained chain of technical actions across diverse targets with no further prompting.[1] The model reasons about what it finds and decides what to try next, without waiting to be told.
The operator configured Hermes Agent with custom red-teaming skill sets labelled godmode, web-terminal-exploitation and fofa-cyberspace-search, and integrated an open-source FofaMap MCP server for asset discovery and automated vulnerability scan generation.[1] FOFA is a Chinese internet-asset search engine analogous to Shodan; feeding it into the agent gave the system a live map of internet-facing infrastructure to work from. The agent used that map to pivot between vulnerabilities based on what it found deployed and how exploitable each configuration appeared.
What the agent hit, and what it missed
The agent attempted exploitation against more than 460 targets across seven exploit tracks, autonomously abandoning unproductive paths and moving to the next vulnerability without any instruction from the operator, yet achieved only three confirmed successful compromises overall.verifiedVerified Source: unit42.paloaltonetworks.com[1] That is a hit rate of well under one per cent. Unit 42 still described the result as proof of a functional autonomous offensive capability, because the machine did exactly what it was designed to do: try everything, drop what fails, move on.
Two of the autonomous attack tracks failed for a revealing reason. Attacks against Langflow, a visual programming tool for AI workflows, targeted the remote-code-execution vulnerability CVE-2026-33017. Attacks against n8n, a workflow-automation platform, targeted CVE-2026-21858 and CVE-2025-68613. Both tracks came up empty because the internet-exposed instances the agent found did not have the specific configurations those exploits required: Langflow systems lacked the auto_login setting and n8n systems lacked unauthenticated form endpoints.[1] The vulnerabilities were real; the targets just did not match the template.
Two other tracks caused actual damage, though Unit 42's report points to these as separate manual operations running alongside the autonomous campaign rather than purely machine-driven actions. A memory-overread flaw in Citrix NetScaler, catalogued as CVE-2026-3055, was used to exfiltrate data from three organisations. A remote-code-execution vulnerability in Marimo, a Python notebook environment, catalogued as CVE-2026-39987, was used to execute commands on 11 separate instances.[1] The researchers acknowledged a discrepancy between those figures and the three confirmed successful compromises but did not fully resolve it.
The operational-security blunder that exposed everything
The Hermes Agent inadvertently exposed the attacker's entire operational workspace by running a public HTTP file server on port 8888, using the Python one-liner python3 -m http.server 8888, making API keys, exploit scripts, session logs and tool configurations freely accessible to Unit 42 researchers, who used them to reconstruct the complete autonomous attack workflow.verifiedVerified Source: unit42.paloaltonetworks.com[1] An autonomous agent designed to exploit other people's misconfigurations was undone by its own.
The exposure points to a structural risk built into autonomous agent frameworks. When a self-driving attack system spins up auxiliary processes to support its operations, such as file servers, scan listeners and logging endpoints, each one is a potential information leak. The agent has no incentive to close them; the operator has to think of everything in advance, because the agent only does what it is told to do, not what it was not told to avoid.
Unit 42 researchers said that while the observed campaign had limited impacts, the workflow confirms a functional, end-to-end autonomous offensive capability.[1] This campaign failed more than it succeeded, but the architecture it demonstrated does not depend on this particular operator improving their craft.
What this means for anyone running an internet-facing server
The practical implication here is not that AI has become a masterful hacker. It is that the cost of running a wide, multi-vector scanning and exploitation campaign has dropped sharply. An operator who once needed a team to simultaneously work seven exploit tracks against hundreds of targets can now do it alone, with a Telegram message and an API key.[1] The agent handles the tedious, repetitive work: discovering assets, matching them to known vulnerabilities, generating and executing exploit code, logging what worked.
The CVEs the agent worked with across Langflow, n8n, NetScaler and Marimo are a useful inventory for any organisation running those platforms. NetScaler is widely deployed in enterprise environments as a networking and application delivery controller, and a memory-overread vulnerability that enables data exfiltration is a serious exposure.[1] Organisations running any of the eight CVEs targeted in this campaign should treat patching as urgent, not routine.
The campaign also highlights the specific risk posed by internet-facing instances of AI and workflow-automation tools. Langflow and n8n are developer platforms that often run in internal or semi-exposed environments without the same patching discipline applied to production web servers. The agent found hundreds of them exposed to the internet and probed every one. The majority were not exploitable, but the agent did not need a majority: it needed three.
SOURCES & CITATIONS
FREQUENTLY ASKED QUESTIONS
What is the Hermes Agent framework and how did it enable autonomous attacks?
Which vulnerabilities did the campaign target?
How did Unit 42 obtain the attacker's tools and logs?
Is this the first time an AI model has been used in a cyberattack?
What should organisations do in response?
Zara Kincaid writes about artificial intelligence and search. Her focus is what happens to businesses when the front page of the internet stops being a list of links and starts being an answer.
