Threat Actor Uses DeepSeek AI and Hermes Agent for Autonomous Server Attacks

Autonomous cyberattacks driven by artificial intelligence are moving rapidly from theoretical proof-of-concepts into active wild operations. A China-based threat actor operating under the handles “knaithe” and “KnYuan” was recently caught running an end-to-end autonomous offensive pipeline using the DeepSeek AI model integrated with the open-source Hermes Agent framework. The threat actor configured the agent to independently discover exposed internet assets, query vulnerability repositories, draft exploit strategies, and execute attack attempts against vulnerable enterprise software—all without requiring real-time human intervention.

While the AI’s autonomous exploitation attempts ultimately failed to breach the targeted systems, the operational speed demonstrated by the setup highlights a significant shift in threat actor capabilities. The system compressed what would typically take a human operator hundreds of hours of manual asset discovery and vulnerability research into mere minutes. Interestingly, the attacker’s infrastructure was exposed after the Hermes Agent accidentally spun up a web server from its own home directory, leaking environment files, API keys, shell history, custom exploit scripts, target lists, and detailed AI activity logs to security researchers at Palo Alto Networks Unit 42.

The Autonomous AI Attack Workflow

Hermes Agent is an open-source AI task execution framework designed to interface directly with operating system terminals, run local commands, write code, and make external HTTP requests. To strip away manual bottlenecks, the threat actor enabled Hermes Agent’s “YOLO” mode—a configuration setting that explicitly instructs the LLM agent to execute system commands and network requests autonomously without prompting the human operator for confirmation. DeepSeek served as the underlying LLM reasoning engine, processing terminal outputs and deciding the next logical step in the attack chain.

The operational pipeline was controlled remotely through a Telegram channel where the operator supplied initial high-level objectives. From there, Hermes operated autonomously by interfacing with custom offensive security toolkits and the FOFA internet asset search engine. When given a directive, the agent used FOFA’s API to map global exposure, pulled public exploit code from online repositories, parsed the exploit requirements, tested targets for required preconditions, and attempted remote code execution.

Target Selection and Exploitation Attempts

In one documented attack session, the operator provided Hermes with an initial instruction to hunt for exposed instances of Langflow—an open-source AI application builder—vulnerable to CVE-2026-33017. The agent queried FOFA, identified 84 reachable instances, downloaded a public proof-of-concept (PoC) exploit, and systematically scanned the endpoints. Upon determining that none of the identified Langflow instances possessed the necessary vulnerable configuration parameters, the agent did not halt. Instead, it pivoted on its own.

DeepSeek analyzed multiple public exploit repositories to select a replacement target class with broader potential impact, landing on n8n, an open-source workflow automation platform. Using FOFA, Hermes identified over 647,000 exposed n8n instances online. It downloaded an exploit script that chained two vulnerabilities—CVE-2026-21858 and CVE-2025-68613—to achieve remote code execution via unauthenticated file uploads. The agent filtered through candidate endpoints and probed them for unauthenticated upload forms required to execute the exploit chain. Ultimately, the candidate forms required valid authentication, causing the automated exploitation attempts to fail.

Manual Operations and Confirmed Compromises

Despite the failure of the autonomous AI campaign to yield footholds, the threat actor was far from inactive. Alongside the AI experiment, “knaithe” / “KnYuan” conducted manual hands-on-keyboard operations targeting more than 460 systems globally. These manual efforts focused on enterprise peripheral devices and infrastructure components, including Apache Tomcat, Marimo Notebook, Windows IKE VPN, and Citrix NetScaler ADC/Gateway devices.

Unit 42 confirmed three successful manual compromises targeting Citrix NetScaler via CVE-2026-3055, an unauthenticated memory disclosure vulnerability. By exploiting CVE-2026-3055, the attacker dumped host process memory from exposed NetScaler appliances to extract sensitive session tokens and administrative authentication cookies, allowing them to hijack active web sessions and bypass authentication barriers. Investigation of the attacker’s exposed setup also revealed pre-configured integrations with several other commercial AI coding and language platforms, including Qwen, GLM, Kimi, MiniMax, Claude Code, and OpenAI’s Codex, indicating an ongoing effort to evaluate multiple LLM engines for offensive operations.

Defense and Remediation

The deployment of autonomous AI agents fundamentally alters target surface risk by allowing threat actors to rapidly probe exposed enterprise infrastructure at massive scale. Organizations operating developer and automation platforms like n8n and Langflow on public-facing IP addresses face immediate automated targeting.

To mitigate exposure to these specific attack chains and autonomous scanning workflows:

• Restrict Perimeter Exposure: Internal automation tools such as n8n and Langflow should never be exposed directly to the public internet without strong edge protection. Restrict access behind zero-trust network access (ZTNA) solutions, VPNs, or strict IP allowlists.
• Patch Core Infrastructure: Apply vendor updates for Citrix NetScaler appliances immediately to remediate the Citrix NetScaler vulnerability CVE-2026-3055, and monitor NetScaler logs for memory extraction or session hijacking anomalies. Ensure n8n instances are updated past CVE-2026-21858 and CVE-2025-68613, and Langflow instances are patched against CVE-2026-33017.
• Implement Rate-Limiting and Bot Detection: Deploy web application firewalls (WAFs) configured to identify and block automated scanning patterns originating from API-driven discovery engines like FOFA, internet census bots, and scripted HTTP request loops.
• Egress and API Monitoring: Monitor outbound server traffic for connections to public AI API endpoints and messaging platforms like Telegram, which are frequently used by autonomous agents for command-and-control communication and instruction fetching.