A China-based operator used DeepSeek through Hermes Agent to automate the ugly middle of hacking: finding targets, pulling exploit code and deciding when to move on.
The scary part of Palo Alto Networks' Unit 42 report isn't that DeepSeek magically broke into hundreds of systems. It didn't. The real story is plainer and more useful: a Chinese-speaking operator using the aliases knaithe and KnYuan wired DeepSeek into the open-source Hermes Agent framework and let it do reconnaissance and exploitation attempts that would normally eat up long hours at a keyboard.
According to Unit 42's July 30 report, the operator controlled the setup through Telegram. Hermes gave the model access to a real working environment, including terminal commands, internet searches, exploit downloads and local files. DeepSeek acted as the reasoning engine, deciding which targets looked worth pursuing and which ones weren't worth more time.
That should bother you.
The AI did the searching, not the whole breach #
Unit 42 recovered a Hermes Agent session from May 7 showing DeepSeek work through exposed Langflow and n8n systems found through FOFA, the Chinese internet-asset search engine. It started with 84 live Langflow instances tied to CVE-2026-33017, found one vulnerable-looking Langflow 1.3.4 target, then dropped the line after the exploit requirements weren't met.
The model's own log was blunt: "All three Langflow need public flow ID but no auto_login, stuck. Deployments small (84 alive), exploitable probably 0. Search for larger-scale vulns." That's a useful sentence because it shows the shift in behavior. The model wasn't just answering a prompt. It was pruning a target set and choosing the next hunt.
Then came n8n. Unit 42 said FOFA showed 647,017 exposed n8n instances globally, including 25,209 in China. DeepSeek sampled roughly 100 Chinese IP addresses, probed about 40 with curl commands, and found three running vulnerable versions. It still failed. The public exploit chain needed an unauthenticated form with file upload, and the observed targets had authentication enabled.
No breach there.
The confirmed damage came from separate manual operations. Unit 42 said the actor exfiltrated data from three Citrix NetScaler targets through CVE-2026-3055, achieved command execution on 11 Marimo notebook endpoints through CVE-2026-39987, tried reverse shells against nine Apache Tomcat servers, and targeted three IKE VPN endpoints. The NetScaler bug was published on March 23 and added to CISA's known exploited vulnerabilities catalog on March 30. NVD lists it as critical, with a 9.8 CVSS 3.1 score.
So the headline isn't that DeepSeek personally compromised 460 systems. Unit 42's harder number is that the actor attempted to exploit more than 460 targets through a mix of autonomous and manual techniques. That distinction matters. Hype makes defenders stupid. The report is serious enough without pretending the machine did every step.
A cheap workflow with a costly mistake #
The setup was messy, but it worked well enough to show the direction of travel. Unit 42 said the operator also configured Qwen, GLM, Kimi and MiniMax, used Claude Code only for connectivity testing and proxy validation, and left signs of Codex usage in exploit development directories. The recovered Codex chat logs weren't preserved, so that part stops there.
DeepSeek did the bulk of the autonomous work Unit 42 could see. Hermes supplied the scaffolding: Telegram command and control, terminal access, a skills system and FOFA search through a Model Context Protocol server. The actor had also added red-teaming skills, including a custom procedure for internet asset enumeration.
Look at the economics. You don't need a state lab for this. Unit 42 assessed the operator as a Zhuhai-based, self-described binary security researcher whose broader activity looked opportunistic. That is exactly why the report lands. A single person could assemble public tools, plug in commercial and Chinese-market AI models, and let the system chew through exposed infrastructure while conserving compute.
Then the same automation burned him. Hermes, responding to a Telegram command, started a Python HTTP file server from the operator's home directory. That exposed model configurations, API keys, exploit scripts, target lists, bash history and Hermes session logs. A careful human might have staged the files somewhere cleaner. The agent opened the cupboard.
Anthropic's November 2025 disclosure showed the higher-end version of this problem, when the company said a Chinese state-sponsored group used Claude Code in attacks against roughly 30 organizations, with AI handling 80% to 90% of the tactical work. The Unit 42 case is smaller and less successful, but in some ways more unsettling. It shows the same pattern moving down-market.
Taiwan's National Security Bureau has separately reported 960,620,609 Chinese cyber intrusion attempts against the island's critical infrastructure in 2025, or about 2.63 million a day, up 112.5% from 2023, according to Infosecurity Magazine's coverage of the NSB report. Nothing in Unit 42's findings ties the DeepSeek campaign to Taiwan. The link is the broader pressure on exposed systems, especially the ones sitting on public patches that haven't been applied.
Patch the known holes first. The autonomous part is new, but the opening it used is painfully familiar.
Also read: Upstart Investors Sue Over an AI Model That Quietly Rejected Borrowers • Hetzner Quietly Launched a Free API for DeepSeek, GLM and Qwen Models • Researchers used AI to build a Zoom hijacking exploit in one day