• 4 min read
DeepSeek-powered agent autonomously attacks exposed servers
Unit 42 says DeepSeek-powered Hermes autonomously scanned targets, selected exploits and attacked exposed servers, though its attempts failed.
Image: BleepingComputer
A Chinese-speaking threat actor used DeepSeek and the open-source Hermes Agent to autonomously scan and attack exposed servers, with only limited human involvement, according to Palo Alto Networks' Unit 42.
The campaign came to light after Hermes accidentally created a web server from its home directory. That error exposed the attacker’s environment, including API keys, exploit scripts, target lists, shell history, and logs of the AI’s activity. Unit 42 attributed the operation to a China-based actor using the aliases “knaithe” and “KnYuan,” who describes themself as a “binary security researcher.”
Although the autonomous activity did not successfully compromise its intended targets, Unit 42 said it demonstrated a complete offensive workflow: finding potential targets, evaluating their weaknesses, selecting exploits, and attempting attacks without continuous operator feedback.
Recommended reading
Anthropic finds three Claude breaches in security tests
“While the observed campaign had limited impacts, the workflow confirms a functional, end-to-end autonomous offensive capability.”
How Hermes used DeepSeek to select targets
Hermes Agent used DeepSeek as its reasoning engine. The framework can interact with operating-system terminals, run commands, and connect to the internet. Its “Yolo” mode allows it to execute commands, including risky ones, without waiting for approval.
The attacker configured Hermes to receive instructions through a Telegram channel, use custom offensive-security skills, and query FOFA, an internet asset-search engine. Unit 42 recovered a session from May 2026 in which the operator appears to have issued only an initial task. Hermes then carried out the rest of the operation autonomously, without human feedback.
The workflow included:
- Targeting internet-exposed Langflow servers vulnerable to CVE-2026-33017.
- Downloading a public proof-of-concept exploit.
- Using FOFA to identify 84 exposed instances and scanning them for vulnerable configurations.
- Abandoning that target class after determining that the available systems could not be exploited.
- Reviewing multiple public exploit repositories before selecting the n8n workflow automation platform as another target.
FOFA identified more than 647,000 exposed n8n instances. Hermes downloaded an exploit chaining CVE-2026-21858 and CVE-2025-68613, identified servers running vulnerable versions, and checked whether they had the unauthenticated file-upload forms needed to complete the attack.
The forms it found required authentication. Unit 42 therefore concluded that the autonomous attempts failed to compromise any of the targeted servers.
AI handled reconnaissance; the operator also attacked manually
Unit 42 said the campaign matters because Hermes independently researched vulnerabilities, assessed which targets were most promising, retrieved exploit code, and attempted attacks within minutes. Tasks that would normally require many hours of manual analysis were compressed into a short automated sequence.
“This autonomous process of target identification, sampling and narrowing of scope is notable because the system executed hundreds of hours of manual targeting analysis in mere minutes, while also managing its own compute resources.”
The actor did not rely exclusively on Hermes. Unit 42 also observed manual attacks against more than 460 systems, involving vulnerabilities in Citrix NetScaler, Apache Tomcat, Marimo Notebook, Windows IKE VPN, and other products.
Researchers confirmed three successful compromises involving the Citrix NetScaler vulnerability CVE-2026-3055. In those intrusions, the actor extracted memory and searched for authentication cookies that could enable session hijacking.
The attacker had configured several other AI coding platforms, including Qwen, GLM, Kimi, MiniMax, Claude Code, and OpenAI’s Codex. Unit 42 found that these systems were used infrequently compared with DeepSeek and Hermes.
Autonomous AI attack flow Source: Palo Alto Unit 42
How this differs from the earlier Hermes incident
The exposed campaign follows another recently disclosed incident involving poorly secured Hermes infrastructure. In that case, Hunt.io and security researcher Bob Diachenko found open web directories containing exploit tools, web shells, credentials, compiled payloads, and Hermes activity logs tied to an alleged attack against Thailand’s Ministry of Finance.
Those logs showed Hermes running in unattended “YOLO” mode for post-exploitation tasks, including searching for privilege-escalation opportunities, enumerating services, inspecting containers, traversing filesystems, and cataloging documents on Ministry of Finance systems.
The earlier incident did not show Hermes independently selecting the target or deciding how to compromise it. A human operator supplied the target, objectives, and attack tools; Hermes automated routine activity after access had apparently already been obtained. The newer Unit 42 findings instead show the agent researching possible vulnerabilities, narrowing its target set, and choosing an exploit path on its own.
Security Editor
Sophia unpacks the invisible wars happening on our networks. Covering cybersecurity, privacy legislation, and cryptography, she exposes how our data is weaponized and defended. Before joining for(geeks), she spent years as a penetration tester. She's the reason the rest of the team uses physical security keys.
via BleepingComputer
