What the autonomous attack looked like and how it surfaced
What Unit 42 documented is a campaign with AI in the operator's seat. The actor, working under the aliases knaithe and KnYuan, used DeepSeek through an open-source framework called Hermes Agent as an autonomous offensive operator. Commands came in over Telegram. The scope covered enumerating targets and their vulnerabilities, sourcing exploit tools, and initiating attacks without human intervention. FOFA, the service used for enumeration, is a search engine for internet-exposed devices and services.
The actor's AI setup (from Unit 42's Table 1)
They configured multiple large language models (LLMs) (Qwen, GLM, Kimi, MiniMax), consistent with evaluating Chinese-market AI models. / Codex: There were signs of usage on exploit development directories, but the chat logs were not preserved. / They routed the two Western tools, Claude Code and Codex, through a third-party proxy service (code.newcli[.]com) to reduce traceability. The actor accessed DeepSeek and Qwen directly through their native API endpoints. The actor enabled anti-attribution settings on both tools. The actor configured Claude Code with CLAUDE_CODE_ATTRIBUTION_HEADER: "0" and CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: "1", while they set Codex to disable_response_storage = true to limit response storage. — From the models configured, the traces of Codex use, and the proxy and anti-attribution settings
DeepSeek reasoned, Hermes Agent acted
The division of labour was clean. Hermes Agent supplied orchestration — terminal access, Telegram command and control, a skills system — while DeepSeek served as the reasoning engine for code generation, vulnerability assessment, target selection, and decision-making. The actor had customised Hermes Agent with three red-teaming skills: godmode for LLM jailbreaking, web-terminal-exploitation for unauthenticated WebSocket exploitation, and a custom fofa-cyberspace-search.
Western tools were touched, but barely. Claude Code was used only for connectivity testing and proxy validation — 10 entries across three sessions containing model checks, connectivity tests, and a single npm install request. It was not used for the actual attacks.
The actor, operating under the aliases knaithe and KnYuan, leveraged DeepSeek, via the Hermes Agent framework, as their autonomous offensive operator. They orchestrated this operator via Telegram for the following activities: Independently enumerating targets and their vulnerabilities using FOFA Sourcing exploit tools Initiating attacks without human intervention / Hermes Agent provided orchestration (terminal access, Telegram-based command and control, and the skills system) while DeepSeek served as the reasoning engine for code generation, vulnerability assessment, target selection and decision-making. / Claude Code: The actor only used this for connectivity testing and proxy validation. Session history (10 entries across three sessions) contained only /model checks, connectivity tests and one npm install request. / The actor had customized Hermes Agent with three red-teaming skills: godmode: LLM jailbreaking, framework-bundled web-terminal-exploitation: unauthenticated WebSocket exploitation, custom-created fofa-cyberspace-search: a custom procedure template instructing DeepSeek to use the actor's fofoapi.py script for internet asset enumeration — From the aliases and DeepSeek's role, the split between Hermes Agent and DeepSeek, the scope of Claude Code use, and the three red-teaming skills
It surfaced because the AI stood up a file server
What made the operation visible from outside was a single careless move. Hermes Agent, responding to a Telegram command, started an HTTP file server from the actor's home directory rather than an isolated staging directory. AI tool configurations, API keys, exploit scripts, target lists, bash history, and the autonomous session logs all became visible.
This was not sloppy tradecraft on the operator's part. Exploit directories were emptied after use and Codex conversation logging was disabled. The automation built for offence produced the forensic artifacts that manual execution would never have left. For other cases where agentic AI led to real-world impact, see the AI worm spreading through Word documents and the intrusion into real companies during an evaluation.
Hermes Agent, responding to a Telegram command, started an HTTP file server (python3 -m http.server 8888) from the actor's home directory (/home/worker) rather than an isolated staging directory. This exposed the actor's entire workspace: AI tool configurations API keys Exploit scripts Target lists Bash history Hermes autonomous exploitation session logs / The exposure was unintentional. The actor demonstrated operational security awareness elsewhere, having emptied exploit directories after use and disabled Codex conversation logging. / The same autonomous capability the actor developed for offensive use directly caused the exposure of the operation, producing forensic artifacts that would not have existed under manual execution. — From the file server exposure, the actor's operational security elsewhere, and the assessment that autonomy generated the evidence
The attack cycle the AI ran by itself
Among the recovered session logs, the record from May 7, 2026 shows the self-driving stretch. After the initial task, Unit 42 was unable to recover any additional operator input. Everything after that is the AI making its own calls.
What the AI did during the May 7, 2026 session
We recovered the following sequence in Figure 1 from a single Hermes Agent session (May 7, 2026). We were unable to recover additional operator input beyond the initial task. / DeepSeek obtained the public n8n exploit PoC from the Chocapikk repository. The PoC chains two CVEs into an attack sequence requiring an unauthenticated form with file upload: CVE-2026-21858 (arbitrary file read, CVSS 10.0) CVE-2025-68613 (sandbox bypass to remote code execution (RCE), CVSS 9.9) / DeepSeek launched parallel scanning across 50-plus remaining Chinese targets. None had publicly accessible forms. The actor did not achieve exploitation. The recovered session data ends at this point. — From the session date and the absence of recoverable operator input, the two chained CVEs, and how the parallel scanning ended
Stuck, it researched again and switched targets
The striking part of this session is what happened after failure. The Langflow vulnerability (CVE-2026-33017) did not go through because the prerequisites were not in place. A CVE is the identifier assigned to a disclosed vulnerability; CVSS scores its severity out of ten, and this one sat at 9.8. At that point DeepSeek judged the product a low-value target and went looking for a vulnerability with a larger footprint. It surveyed deployment counts for 10 product families via FOFA, searched GitHub for trending 2026 CVE proof-of-concept repositories sorted by stars, and evaluated candidates on severity, deployment footprint, and exploitability before landing on n8n.
FOFA put n8n at 647,017 instances globally and 25,209 in China. It was the AI, not the operator, reselecting the target on cost-effectiveness.
DeepSeek identified a Langflow vulnerability (CVE-2026-33017, CVSS 9.8) and autonomously attempted exploitation through the following steps: Downloading the public PoC exploit from GitHub Enumerating 84 Langflow instances via FOFA (title="Langflow") / All three Langflow need public flow ID but no auto_login — stuck. Deployments small (84 alive), exploitable probably 0. Search for larger-scale vulns. / After abandoning Langflow, DeepSeek conducted autonomous research to identify a higher-value vulnerability. It surveyed deployment counts across 10 product families via FOFA, and then searched GitHub for trending 2026 CVE PoC repositories sorted by stars. DeepSeek evaluated each candidate by severity, deployment footprint and exploitability before selecting n8n / FOFA confirmed n8n as a high-value target: 647,017 instances globally; 25,209 in China. — From the Langflow attempt and the AI's own withdrawal reasoning, the target reselection process, and the n8n deployment counts
From 25,209 hosts down to 40, narrowed by the AI itself
The handling of scale is just as notable. FOFA found 25,209 n8n instances in China. DeepSeek sampled roughly 100 IP addresses out of those, then probed about 40, checking versions with curl. Unit 42 reads this as narrowing to conserve AI compute.
Three turned out to run vulnerable versions, and exploitation was attempted automatically. Authentication on the form stopped it. Hundreds of hours of manual targeting analysis were compressed into minutes — while the system also managed its own compute budget.
What’s interesting is that the actor appeared to allow DeepSeek to narrow the targeting scope, likely to conserve AI compute. For example, DeepSeek sampled approximately 100 IP addresses out of the 25,209 Chinese systems that FOFA scans identified with exposed n8n instances. Of those 100 systems, it probed roughly 40 unique IP addresses, checking their version via curl commands. While most of the systems were unreachable or non-responsive, DeepSeek found three with the vulnerable versions and attempted to exploit them automatically. This autonomous process of target identification, sampling and narrowing of scope is notable because the system executed hundreds of hours of manual targeting analysis in mere minutes, while also managing its own compute resources. — From the sampling and narrowing process and what Unit 42 makes of it
What damage was confirmed, and what defenders should take from it
This is the part that gets misread. The autonomous attacks produced no results. The confirmed damage came from conventional manual work with no AI involved.
Vulnerabilities used and how (from Unit 42's Table 2)
| Product | CVE / CVSS | Method | Outcome |
|---|---|---|---|
| Langflow | CVE-2026-33017 / 9.8 | Autonomous | Failed (prerequisite config absent) |
| n8n | CVE-2026-21858, CVE-2025-68613 / 10.0, 9.9 | Autonomous | Failed (authentication required) |
| Citrix NetScaler | CVE-2026-3055 / 9.8 | Manual | Data exfiltration confirmed |
| Marimo Notebook | CVE-2026-39987 / 9.8 | Manual | Command execution confirmed |
| Apache Tomcat | CVE-2026-34486 / 7.5 | Manual | Reverse shell attempts |
| Windows IKE VPN | CVE-2026-33824 / 9.8 | Manual | Reverse shell attempts |
| PAN-OS | CVE-2026-0300 / 9.8 | Manual | PoC cloned only, not executed |
CVE-2026-33017 Langflow 9.8 Autonomous Exploitation attempt (failed — auto_login disabled) CVE-2026-21858 /CVE-2025-68613 n8n Workflow Automation 10.0 / 9.9 Autonomous Exploitation attempt (failed — auth required) CVE-2026-3055 Citrix NetScaler ADC & Gateway 9.8 Manual Active exploitation, data exfiltrated CVE-2026-34486 Apache Tomcat 7.5 Manual Active exploitation, reverse shell attempts CVE-2026-39987 Marimo Notebook 9.8 Manual Active exploitation, command execution confirmed CVE-2026-0300 PAN-OS User-ID Authentication Portal 9.8 Manual Non-functional research PoC cloned, not executed CVE-2026-33824 Windows IKE Extensions (IKE VPN) 9.8 Manual Active exploitation, reverse shell attempts / The cloned code is non-functional with placeholder values that cannot achieve code execution. No evidence of modification or execution was found. — From every row of Table 2 "CVEs Exploited or Staged" and the note that the PAN-OS PoC was never executed
The confirmed damage came from manual operations
Autonomous and manual combined, over 460 targets were attempted. Two instances of real damage were confirmed. Memory data exfiltrated from three Citrix NetScaler targets, and command execution on 11 Marimo notebook endpoints. In the first case the exfiltrated data was searched for NetScaler authentication cookies, which the report reads as session hijacking intent.
Why the autonomous side came up empty is equally clear. Langflow lacked the required configuration; n8n had authentication on the form endpoint. Target-side configuration is what stopped it, and Unit 42 says targets with weaker default configurations would have been susceptible. That is the basis for calling the margin narrow.
From our analysis and visibility, we identified that this actor attempted to exploit over 460 targets, leveraging a mix of autonomous and manual techniques. / Across all the exploitation attempts, both autonomous and manual, Unit 42 confirmed data exfiltration from three Citrix NetScaler targets (CVE-2026-3055) and command execution on 11 Marimo notebook endpoints (CVE-2026-39987). / The three successful exploitations had memory data exfiltrated through the Citrix NetScaler out-of-bounds memory read vulnerability (CVE-2026-3055). The actor searched the exfiltrated data for NetScaler authentication cookies (NSC_AAAC=), indicating session hijacking intent. — From the number of targets attempted, the two confirmed instances of damage, and the search for authentication cookies in the exfiltrated data
A model with weak safety controls was chosen deliberately
The heaviest finding for defenders is that the model choice was deliberate. For the autonomous attack engine, the actor selected a model with minimal safety controls — DeepSeek — accessed through an open-source framework with no client-side restrictions. Western models were attempted, but provider-side controls likely limited their effectiveness for autonomous attacks.
OpenAI, for its part, confirmed that its provider-side safeguards refused requests violating its policies, and that continued attempts led its safety systems to flag and disable an account believed linked to this campaign before Unit 42 shared intelligence with them. Provider controls were not bypassed. A looser model was chosen as the detour.
Exploitation was prevented by target-side configuration requirements — the absence of prerequisite workflow configurations (Langflow) and authentication on form endpoints (n8n). Targets with weaker default configurations would have been susceptible. / Threat actors follow the path of least resistance: For their autonomous attack engine, the actor selected a model with minimal safety controls (DeepSeek) accessed through an open-source framework with no client-side restrictions. The actor attempted to use Western models, but their provider-side controls likely limited their effectiveness for autonomous attacks. / Note: Our colleagues at OpenAI were able to confirm that their provider-side safeguards refused requests that violated their policies. They also confirmed that continued attempts led their safety systems to flag and disable an account they believe is linked to this campaign prior to our intelligence sharing with their team. — From why exploitation was prevented, the assessment of the model choice, and OpenAI's response
The Unit 42 report is long, in English, and mixes tables with code. Converting the page to Markdown before reading is the safer route if you need the CVE numbers and configuration values intact.
Conclusion: what stopped it was target-side configuration
No autonomous AI in this campaign achieved full compromise. Defenders still cannot shrug it off, because what stopped it was not a limit on the attacker's side but configuration on the target's. A prerequisite left disabled, authentication on a form. Differences that small decided the outcome. When it got stuck the AI researched other vulnerabilities itself, narrowed 25,000 hosts to 40, and finished targeting analysis in minutes. If you take one action, take inventory of the devices you have exposed with default settings. Automated attacks work through the loosely configured first.
