Chinese hacker used DeepSeek to launch autonomous cyberattacks on vulnerable servers

Chinese threat actor 'knaithe' and 'KnYuan' used DeepSeek and other large language models to automate cyberattacks against internet-facing systems, according to researchers at Palo Alto Networks' Unit 42. The operation was exposed after the actor's AI agent misconfigured a file server, revealing the full tool set and targeting methods.

A Chinese threat actor operating under the aliases “knaithe” and “KnYuan” used multiple LLMs to automate cyberattacks against internet-facing systems with limited human intervention. Researchers at Palo Alto Networks’ Unit 42 uncovered the operation after the threat actor’s AI agent misconfigured a file server, inadvertently exposing the entire infrastructure. “This visibility enabled us to understand their full tool set, how the attackers orchestrated multiple AI platforms and gave us a peek into their targeting,” Unit … More https://www.helpnetsecurity.com/2026/08/03/deepseek-ai-autonomous-cyberattacks-hermes-agent/ The post Chinese hacker used DeepSeek to launch autonomous cyberattacks on vulnerable servers https://www.helpnetsecurity.com/2026/08/03/deepseek-ai-autonomous-cyberattacks-hermes-agent/ appeared first on Help Net Security https://www.helpnetsecurity.com .