# A Chinese Hacker Used DeepSeek to Attack 460 Systems With One Command

> Source: <https://startupfortune.com/a-chinese-hacker-used-deepseek-to-attack-460-systems-with-one-command/>
> Published: 2026-08-02 15:20:03+00:00

*A Chinese-speaking hacker turned DeepSeek into a fully autonomous attacker after Claude and OpenAI's guardrails refused the job, and Palo Alto Networks says the resulting campaign hit more than 460 systems with almost no human input.*

The hacker, tracked by Palo Alto Networks' Unit 42 under the aliases "knaithe" and "KnYuan," wired DeepSeek into an open-source framework called Hermes Agent and gave it control of a terminal, the internet, and its own judgment. One Telegram message was enough to set it loose. According to Unit 42's report, published July 30, 2026, the operator then largely stepped back while the AI scanned for vulnerable servers, picked exploits off GitHub, and launched the attacks itself.

This isn't a hypothetical about what agentic AI might someday do. It already did it, on real infrastructure, across roughly 460 attempted targets.

Unit 42 says the pipeline started with Langflow, a low-code AI development platform, where DeepSeek hunted down 84 servers still exposed to CVE-2026-33017. From there it pivoted to n8n, the workflow automation tool, where Unit 42 counted more than 647,000 internet-facing instances, a much bigger pool to work through. The AI selected its own targets, sourced its own exploit code, and ran the attacks with minimal oversight.

Most of it failed. Unit 42 confirmed only three successful compromises out of roughly 460 attempts: memory data pulled from Citrix NetScaler devices, and a suspected session hijacking attempt against a Malaysian government entity. A hit rate under one percent isn't a triumph of AI hacking. But a fully automated pipeline that runs unattended and occasionally breaks through is a capability that didn't exist at this scale a year ago.

The researchers only found the campaign because Hermes made a mistake of its own. The framework accidentally spun up a web server from its own home directory, exposing the attacker's entire operation: API keys, exploit scripts, target lists, shell history, and the AI's own attack logs. The hacker got caught by the same autonomy that made the operation possible in the first place.

Unit 42's report notes the operator tried Claude and OpenAI's models for the same job first. Their safety controls blocked the offensive requests. DeepSeek didn't. That's a notable data point on its own: it may be the first documented real-world case where a frontier lab's guardrails kept a model out of an active attack chain while an open-weight competitor got recruited instead. Separate adversarial testing covered by CyberSecurityNews found DeepSeek R1 had a 100% attack success rate in harmful-prompt trials, meaning it didn't block a single request researchers threw at it, a sharp contrast with models that at least partially resisted.

This campaign didn't arrive in isolation. On July 21, Forbes reported that Hugging Face CEO Clément Delangue warned publicly that attackers are already using AI agents in the wild, not as a future risk but as current practice. The DeepSeek and Hermes Agent case is the concrete example behind that warning: a freely downloadable model, a public agent framework on GitHub, and a single Telegram command turned into an automated intrusion pipeline that needed no custom malware and no dedicated hacking team.

For security teams, the practical lesson isn't really about DeepSeek. It's about what any sufficiently capable open-weight model plus an agent wrapper can now do with barely any engineering effort behind it. CISOs should treat exposed Langflow and n8n instances as immediate patching priorities, since they're the exact software this campaign already targeted. But the deeper shift is architectural. Defenders can no longer assume that scanning and exploiting at scale requires a skilled operator sitting at a keyboard. Increasingly, it just requires access to a model willing to say yes.

Unit 42 hasn't disclosed whether "knaithe" has been identified beyond an assessed location in Zhuhai, China, or whether law enforcement has gotten involved. The Hermes Agent framework itself is still sitting on GitHub, free for anyone to download.

**Also read:** [AI Firms Are Buying and Pulping Rare Books After Scanning Them for Training Data](https://startupfortune.com/ai-firms-are-buying-and-pulping-rare-books-after-scanning-them-for-training-data/) • [Google Built ChatGPT's Ancestor in 2018 and Watched Its Creator Leave Twice](https://startupfortune.com/google-built-chatgpts-ancestor-in-2018-and-watched-its-creator-leave-twice/) • [DeepSeek's V4-Flash Undercuts OpenAI and Anthropic on Price Again](https://startupfortune.com/deepseeks-v4-flash-undercuts-openai-and-anthropic-on-price-again/)