A threat actor based in Zhuhai wired DeepSeek into an open-source agent framework called Hermes, then piloted the whole setup via Telegram to attack hundreds of internet-facing systems. Palo Alto Networks' Unit 42 published the analysis on August 2.
Here's what matters: it's not an edge case. The attacker wove together three off-the-shelf pieces, a frontier AI model, a published agent framework, and a messaging platform, into a working attack loop. DeepSeek enumerated targets, sourced public exploits from the open internet, and executed them. The Telegram interface let the operator steer in real time without touching a command line.
The scale is concrete. The actor hit 460+ systems across multiple victims. Unit 42 tied the campaign to a known Zhuhai-based group with a track record of targeting manufacturing and software companies in Asia-Pacific. This wasn't a proof-of-concept run in a lab. It was active, operational, and effective enough that Palo Alto documented and named it.
The interesting part is how little friction there was. Hermes is open source. DeepSeek is accessible. Telegram is free. The gap between "here's a capable AI model" and "here's a weaponized agent" compressed from weeks to days. A moderately skilled operator could replicate this setup without reverse-engineering anything. They could wire a different model in. They could change the target scope or the exploit selection logic. The framework stays the same.
This sits in a space we've been edging toward all year: frontier models are now the execution engine inside attack automation, not the bottleneck. The bottleneck used to be writing reliable exploits or scanning code. Now it's choosing your framework, plugging in your model, and deciding what to hit. An API call replaces the engineering.
What I notice is that the attacker chose DeepSeek, not GPT-5.5 or Claude Opus. That matters because it signals something about model access, economics, and intent. DeepSeek is cheaper to run, harder to log (fewer official guardrails about audit trails), and easier to operate in jurisdictions where Western APIs face scrutiny. If cost and operational security shaped the decision, then cheaper, lighter open-weight models might see more of this use before expensive frontier models see it.
Unit 42 didn't speculate on intent, just published the technical chain. They traced it. They named it. They showed the payload and the messaging protocol. That's the kind of clarity we need on this problem, because the next iteration won't look like a security firm's published sample. It will look faster, more automated, and harder to trace. This one was caught because someone was paying attention. Not all of them will be.