Chinese Hacker Used DeepSeek AI to Autonomously Launch Cyberattacks Against Hundreds of Targets

A Chinese-speaking threat actor weaponized the DeepSeek AI model through an open-source agent framework to launch autonomous cyberattacks against more than 460 internet-facing systems after a single Telegram command.

The case represents a significant escalation in AI-assisted hacking. For the first time, researchers have documented an operator stepping away entirely after issuing one instruction and allowing an AI reasoning model to identify targets, select exploits, and execute attack sequences without further human input. That hands-off approach signals a new chapter in how adversaries are lowering the operational cost of large-scale exploitation campaigns.

Understanding this incident requires some context around how AI is actively reshaping the cybersecurity threat landscape — and why the acceleration of autonomous attack tooling has caught many organizations off guard.

---

How the Autonomous Attack Unfolded

Palo Alto Networks' threat intelligence team Unit 42 published findings on July 31, 2026, revealing that the operator used the open-source Hermes Agent framework with DeepSeek as its primary reasoning model. The framework provided terminal access, reusable skills, and unattended execution. Unit 42 also found limited use of Claude Code and Qwen Code within the same environment, along with signs of Codex use in exploit-development directories — though chat logs confirming actual Codex activity were not preserved.

The operator is tracked under the aliases knaithe and KnYuan. Unit 42 assesses the individual to be based in Zhuhai, China, a conclusion consistent with a GitHub profile displaying the name "KnYuan Knaithe" and an older blog under the same handle describing its author as a binary security researcher in Zhuhai. Those profiles do not establish the operator's legal identity or any confirmed state connection.

The Attack Sequence in Detail

In a recovered May 2026 session, DeepSeek downloaded a public exploit for the Langflow code-injection vulnerability CVE-2026-33017, used the FOFA internet-scanning service to enumerate 84 Langflow instances, and identified one target running version 1.3.4. Langflow is an AI agent and workflow builder. The attack stalled because the system did not have auto_login enabled and lacked a usable public flow identifier.

Rather than abandoning the operation, the agent pivoted autonomously. It surveyed 10 product families, searched GitHub for recent proof-of-concept repositories, and selected n8n — the workflow automation platform — as its next target. It then obtained a two-vulnerability chain combining the unauthenticated file-access flaw CVE-2026-21858 with the expression-injection issue CVE-2025-68613. FOFA returned 25,209 n8n systems in China during the session. DeepSeek sampled approximately 100, probed roughly 40, and identified three running vulnerable versions. All accessible form endpoints required authentication and no n8n system was ultimately compromised.

How the Operation Was Exposed

The operation was ultimately exposed by a mistake inside the Hermes Agent framework itself. The agent started a Python HTTP server on port 8888 from the /home/worker directory. That unintended server made the actor's model configurations, API keys, exploit scripts, target lists, shell history, and autonomous session logs publicly accessible — effectively handing investigators a complete operational record. In security terms, the attacker's entire toolkit was left open on the internet, much as a burglar might drop their bag of tools at the scene.

---

Seven Exploit Tracks and Confirmed Victims

Unit 42 described seven exploit tracks spanning eight CVE identifiers, because the n8n chain combines two vulnerabilities. Despite the scale of attempted targeting, the report confirms only three successfully exploited organizations across the entire operation.

In separate manual operations, the team documented data exfiltration from three organizations through the NetScaler memory-overread flaw CVE-2026-3055 and command execution on 11 Marimo notebook instances through CVE-2026-39987. The report does not fully reconcile those specific figures with the broader confirmed total of three compromised targets. The Hacker News has contacted Palo Alto Networks for clarification and will update the story with any response.

What Made This Campaign Distinctive

What distinguishes this campaign from previous AI-assisted intrusion attempts is the degree of autonomous decision-making involved. The DeepSeek agent checked software versions, downloaded exploits, abandoned unproductive attack paths, and selected alternative vulnerabilities based on severity, deployment scale, and apparent exploitability — all without a human operator present. This is not a case of AI accelerating a human-directed attack; it is a case of AI replacing the human during execution entirely.

This represents a documented shift in attacker economics. Traditionally, scaling an exploitation campaign across hundreds of targets required proportional human effort — reconnaissance, triage, and manual pivot decisions at each stage. Autonomous agent frameworks collapse that cost to a single command. Security teams should treat this not as an isolated incident but as a preview of the operational tempo adversaries can now sustain.

This kind of capability evolution is consistent with the broader risks and challenges that AI introduces across business and security operations — risks that are no longer confined to theoretical scenarios.

---

Patches Available and What Organizations Must Do Now

Every vulnerability exploited or attempted in this campaign has a vendor-issued fix available.

• Langflow patched CVE-2026-33017 in version 1.9.0
• n8n patched CVE-2026-21858 in version 1.121.0 and CVE-2025-68613 in versions 1.120.4, 1.121.1, and 1.122.0 — version 1.121.1 is the earliest release addressing both flaws used in the attempted chain
• Marimo patched CVE-2026-39987 in version 0.23.0
• Citrix NetScaler ADC and Gateway appliances configured as SAML identity providers are affected by CVE-2026-3055 — administrators can identify exposure by checking configurations for the add authentication samlIdPProfile parameter and installing fixed builds listed in Citrix's security bulletin

Unit 42 recommends that organizations patch exposed Langflow, n8n, and Marimo systems immediately. They should also remove unnecessary public access to workflow and notebook interfaces and audit any customer-managed NetScaler appliances operating as SAML identity providers.

Practical Steps for Security Teams and Business Leaders

For security teams and business leaders, the practical takeaways are clear. Maintaining current patch levels on workflow automation and AI development tools is now a front-line defense against AI-driven exploitation at scale. Restricting internet exposure of internal tools like n8n and Marimo eliminates the attack surface these agents depend on for enumeration. Monitoring for unexpected outbound HTTP servers and unauthorized API key usage can surface compromised environments before an autonomous agent completes its mission.

Understanding the Threat Actor Profile

It is also worth noting what this incident reveals about the emerging attacker profile. The operator tracked as knaithe and KnYuan is not described as a nation-state actor — there is no confirmed state connection — but as an individual binary security researcher who assembled commercially available AI models, open-source agent frameworks, and public exploit databases into a functional autonomous attack pipeline. The barrier to building this kind of capability is falling. Organizations facing this threat are not necessarily up against well-resourced government programs; they may be facing a single technically skilled individual operating from a home environment.

For a broader perspective on the range of actors and motivations behind incidents like this, understanding the different types of hackers and their methodologies provides useful grounding for risk assessment and security planning.

The Cybersecurity and Infrastructure Security Agency (CISA) maintains a continuously updated Known Exploited Vulnerabilities catalog that organizations can reference to prioritize patching decisions, particularly for internet-facing systems of the kind targeted in this campaign.

AI-assisted autonomous hacking is no longer theoretical. This incident demonstrates that the tools, the reasoning capability, and the operational template now exist in the wild — and that a single misconfigured server was all that stood between a successful covert campaign and complete operational exposure.