A hacker from the Chinese city of Zhuhai used the AI model DeepSeek to automatically find and attack vulnerabilities in more than 460 internet-accessible systems. That is according to an analysis by the security firm Palo Alto Networks. Three Citrix NetScaler servers and eleven Marimo notebook instances were actually breached, while the fully automated AI attack attempts themselves produced no confirmed success.
Hermes framework steers DeepSeek via Telegram remote access
The attacker identifies himself online as “knaithe” or “KnYuan” and describes himself as a binary security researcher. For the attacks, he used the open-source framework Hermes Agent as his control center. Hermes gives the connected AI model terminal access to a system, remote control via the messenger Telegram, and a library of reusable attack capabilities. DeepSeek supplied the actual attack logic: it selected targets, assessed vulnerabilities, and initiated matching exploit steps, while Hermes handled execution.
The actor additionally ran a pipeline called 1DayNews that automatically collects newly published vulnerabilities from 17 sources. From that feed, he continuously derived new attack targets. Unit 42 places the attacker in the city of Zhuhai in China’s Guangdong province. A publicly visible GitHub profile and a personal blog belonging to the actor support that assessment – the exact origin is not independently verified, however. Besides DeepSeek, the actor reportedly also tested the Chinese models Qwen, GLM, Kimi, and MiniMax for possible practical use, but did not deploy them productively in the documented attack.
Known Citrix flaw remains an entry point despite a patch
The fully autonomous attack attempts run by Hermes and DeepSeek consistently failed due to configuration hurdles. They targeted, among other things, the automation platform Langflow via the vulnerability CVE-2026-33017. Two further attempts against the workflow software n8n via other critical flaws also produced no confirmed compromise.
The actor succeeded, however, in manual or AI-assisted operations outside the fully automated mode. At three systems running the remote-access software Citrix NetScaler, he used the vulnerability CVE-2026-3055 to extract memory contents and the login cookies contained in them. Citrix had already disclosed and fixed this flaw in its own security bulletin in March 2026, yet it remained exploitable on unpatched systems. At eleven instances of the data-analysis tool Marimo, which data teams use for interactive Python notebooks, the attacker executed his own code via the vulnerability CVE-2026-39987. A compromised NetScaler gateway can have far-reaching consequences, since companies typically use it to handle secure remote access for employees into internal networks. In total, the actor probed more than 460 internet-accessible systems, automatically and manually, for exploitable configurations.
Exposed web server gives away the attack infrastructure
The campaign came to light because Hermes Agent accidentally started its own HTTP server in the attacker’s working directory instead of running it in an isolated environment as intended. As a result, API keys, exploit scripts, target lists, command-line history, and complete logs of the autonomous AI sessions sat openly accessible online. Unit 42 analyzed this data and reconstructed a session from May 7, 2026, that documents the full course of one automated attack.
The actor also tested commercial US models for his purposes. Ten test sessions with Anthropic’s Claude Code served only to check connectivity. OpenAI’s Codex, based on GPT-5.4, ran into the provider’s safeguards instead: requests that violated usage policies were reportedly blocked, and the account used was subsequently suspended. According to the available findings, DeepSeek did not refuse to take part in the attacks. This is not the first documented case of an AI system in a real attack. In July 2026, according to OpenAI, two of its own models independently breached Hugging Face’s infrastructure as part of an internal security test. There, however, the attack stemmed from a controlled test, not from an external actor.
What matters now is whether companies speed up their patch cycles. The successful breaches hit exclusively systems with a vulnerability that had been known and already fixed for months, not a newly discovered flaw. AI agents like Hermes mainly cut the effort needed to automatically find such unpatched systems at scale – the actual safeguard remains the timely installation of available updates.
