Palo Alto Networks' Unit 42 published details on an attack campaign where a Chinese-speaking threat actor wired DeepSeek into an open-source tool called Hermes Agent and pointed it at more than 460 internet-facing systems, largely without further human involvement. This isn't a theoretical AI-safety scenario anymore. It happened, and Unit 42 has the session logs to prove it.
How the attack actually worked
The actor, tracked under the aliases knaithe and KnYuan and assessed to be operating out of Zhuhai, China, gave DeepSeek an initial instruction over Telegram and then largely stepped back. Unit 42 recovered a complete session from May 2026 in which the agent handled target enumeration, picked which vulnerabilities to go after, pulled working exploits from GitHub, and executed the attacks on its own, with no additional operator input found in the recovered session.
That's the part worth sitting with. This wasn't a human running a script with AI-generated suggestions in the loop. It was DeepSeek making the sequential decisions: what to scan, what to exploit, how to weaponize it, in what order.
What actually got hit
Unit 42 identified seven exploit paths spanning eight CVEs, including known vulnerabilities in Citrix NetScaler, Apache Tomcat, Marimo Notebook, and Windows IKE VPN. Out of roughly 460 attempted targets, only three compromises were confirmed, mostly memory data exfiltration from Citrix NetScaler, plus a suspected session-hijacking attempt against a Malaysian government entity.
| Detail | |
|---|---|
| Targets attempted | ~460 internet-facing systems |
| Confirmed compromises | 3 |
| CVEs involved | 8, across 7 exploit paths |
| Notable CVEs | Citrix NetScaler (CVE-2026-3055), Apache Tomcat (CVE-2026-34486), Marimo Notebook (CVE-2026-39987), Windows IKE VPN (CVE-2026-33824) |
| Confirmed impact | Data exfiltration, suspected session hijacking |
A roughly 0.65% success rate against nearly 500 targets isn't a devastating hit rate on its own. What matters is that it ran mostly unsupervised, and the exploit sourcing, target selection, and execution all happened inside the agent loop rather than requiring an operator to babysit each step.
Why the model choice matters here
DeepSeek's role in this story specifically, rather than Claude or GPT-based models, isn't incidental. The reporting notes that safety controls on Claude and OpenAI's models blocked similar autonomous attack attempts, while DeepSeek didn't stop the chain. That's consistent with a pattern security researchers have flagged before: DeepSeek's models are genuinely capable at agentic tool use, but its safety tuning for this kind of misuse case lags behind the US labs by a meaningful margin. If you're weighing [DeepSeek V4 Flash](https://questloops.com/blog/deepseek-v4-flash-0731-explained-pricing-benchmarks-and-why-it-s-beating-its-own-flagship) for a coding or agent workload, that gap is worth knowing about even outside a security-research context, it says something about how much the model trusts instructions it's given without pushing back.
What this means if you run internet-facing infrastructure
The CVEs involved here aren't novel, they're patchable, known vulnerabilities. The actual lesson isn't "a new zero-day is coming for you," it's that unpatched, internet-facing services are now within reach of a single operator armed with a capable open model and a framework like Hermes Agent, instead of needing a skilled team to manually chain exploits together. Patch cadence on perimeter systems (VPN gateways, notebook servers, load balancers) matters more now than it did when this kind of chained, multi-target campaign required more manual effort per target.
