Cybersecurity researchers at **Palo Alto Networks' Unit 42** have uncovered a concerning development in the threat landscape: a Chinese-speaking actor is utilizing advanced AI models to orchestrate autonomous cyberattacks. The operation, attributed to an individual or group operating under the aliases "knaithe" and "KnYuan," employs the **DeepSeek** AI model as a reasoning engine for the **Hermes Agent**, an open-source AI framework. ### Accidental Exposure Reveals AI Offensive The discovery came to light when the **Hermes Agent** inadvertently created a web server from its home directory, exposing the attacker's environment. This critical misstep revealed a trove of information, including API keys, exploit scripts, target lists, shell history, and detailed AI attack logs. While the observed autonomous attacks did not result in successful compromises, **Unit 42** emphasizes that the campaign demonstrates a fully functional, end-to-end autonomous offensive capability. "While the observed campaign had limited impacts, the workflow confirms a functional, end-to-end autonomous offensive capability," **Unit 42** stated. ### DeepSeek Drives Autonomous Reconnaissance and Exploitation The threat actor configured **Hermes** to operate in a "Yolo" mode, allowing it to execute commands, even risky ones, without requiring operator permission. The agent received initial instructions via a Telegram channel and integrated with the **FOFA** internet asset search engine for target identification. Custom offensive-security skills further augmented its capabilities. In a recovered May 2026 session, the operator provided only an initial task. From that point, the agent autonomously handled the remaining activities. It initially targeted internet-exposed **Langflow** servers vulnerable to **CVE-2026-33017**, downloading a public proof-of-concept exploit and scanning 84 instances identified through **FOFA**. When these targets proved unexploitable, the agent independently researched alternative vulnerabilities. **DeepSeek** then analyzed multiple public exploit repositories before selecting the **n8n** workflow automation platform, which had over 647,000 exposed instances identified via **FOFA**. The agent downloaded an exploit chaining **CVE-2026-21858** and **CVE-2025-68613** and proceeded to scan for vulnerable versions and unauthenticated file-upload forms. However, these forms required authentication, preventing successful exploitation. ### The Speed of AI-Driven Attacks **Unit 42** highlights the profound significance of this campaign: the AI agent independently researched vulnerabilities, prioritized targets, downloaded exploit code, and attempted exploitation in mere minutes. This process would typically consume hundreds of hours of manual analysis. "This autonomous process of target identification, sampling and narrowing of scope is notable because the system executed hundreds of hours of manual targeting analysis in mere minutes, while also managing its own compute resources," explained **Palo Alto Networks**. Beyond the AI-driven efforts, the threat actor also conducted manual attacks against over 460 systems, targeting vulnerabilities in products like **Citrix NetScaler**, **Apache Tomcat**, **Marimo Notebook**, and **Windows IKE VPN**. Three successful compromises were confirmed against the **Citrix NetScaler** vulnerability **CVE-2026-3055**, used to extract memory and search for authentication cookies for session hijacking. While other AI coding platforms like **Qwen**, **GLM**, **Kimi**, **MiniMax**, **Claude Code**, and **OpenAI's Codex** were configured, **Unit 42** observed they were not frequently used.  ### Hermes's Prior Engagements This incident follows another recent disclosure involving poorly secured **Hermes** infrastructure, which exposed details of an alleged cyberattack against Thailand's Ministry of Finance. In that earlier case, security researchers **Hunt.io** and **Bob Diachenko** discovered open web directories containing exploit tools, web shells, credentials, and **Hermes** activity logs. Those logs showed **Hermes** operating in unattended "YOLO" mode to automate post-exploitation activities, including privilege escalation, service enumeration, container inspection, filesystem traversal, and document cataloging within the Ministry of Finance's systems. However, unlike the current campaign, the earlier incident did not demonstrate **Hermes** independently selecting targets or determining initial compromise methods. A human operator provided the targets, objectives, and initial attack tools, with **Hermes** automating subsequent actions.