His AI Ran the Whole Attack. It Also Published His API Keys to the Open Internet.

Palo Alto Networks published a report on July 30. It documents a Chinese speaking operator who wired DeepSeek into the open source Hermes Agent framework and ran it over Telegram. After a single opening instruction, the agent enumerated targets, researched vulnerabilities, pulled exploit code off GitHub, and attacked. Investigators recovered no further human input from that session. The operator tried Claude Code and Codex first. Provider safety controls got in the way, so he settled on the model with the fewest. Every autonomous attempt failed. All three confirmed compromises came from old fashioned manual hacking instead. Investigators only saw any of it because the agent, following a Telegram command, started a web server in its owner’s home directory. That published his API keys, target lists, and session logs to anyone who looked.

The agent got a Telegram message asking it to serve some files.

So it ran python3 -m http.server 8888 from /home/worker. Unfortunately for him, that’s the wrong directory. That’s where its owner kept everything. API keys. Exploit scripts. Target lists. Bash history. The complete logs of every autonomous attack session it had run.

All of it, on the open internet, indexed and waiting.

That is, in the end, how Unit 42 got the story. Not through a breach, not through an informant. The attack tool published its own case file.

What the Report Actually Says

Coverage of this has been sloppy so far. Here’s the split between what happened and what people are saying happened, per The Hacker News and the original research.

Unit 42’s own framing is that the campaign had limited impact. The workflow, though, confirms a functional end to end autonomous offensive capability.

That distinction is the whole article. The results were bad. Still, the machine worked.

Claude Said No. Codex Said No. DeepSeek Didn’t Care.

Certainly this is the part that should get more attention than it has.

The operator tried Western tools first, of course. Unit 42 recovered Claude Code session history showing ten entries across three sessions. The contents: model checks, connectivity tests, and a single npm install request. That’s it. He had configured it aggressively too. Opus ran through a proxy at code.newcli[.]com, with dangerously-skip-permissions set to true. Twelve tools were explicitly allowlisted, including Bash, file operations, web requests, and agent spawning.

Then he stopped using it.

Codex got the same answer

Codex got the same treatment. He marked his exploit development directories as trusted, granting full read, modify, and execute access. He also set disable_response_storage = true so conversations wouldn’t be kept. Unit 42 recovered no Codex chat logs. That setting only affects local storage, though, and does nothing to the provider’s own safety logging.

Unit 42’s read: the actor attempted to use Western models, provider side controls likely limited their effectiveness for autonomous attacks, and so he picked the most permissive model available. They also got confirmation from OpenAI directly. Provider side safeguards refused requests that violated policy. Continued attempts then caused safety systems to flag and disable an account believed linked to the campaign, before Unit 42 had shared any intelligence with OpenAI’s team.

Where he ended up instead

So the safety systems worked. Not perfectly, not as a wall, but as friction significant enough that a motivated attacker gave up and went shopping.

Then he found DeepSeek, which he accessed directly through the native API with no proxy at all. Hermes Agent’s entry in the tool table lists no built in safety layer. It also lists custom red teaming skills and a bundled godmode jailbreaking skill.

No client side restrictions. Nor any server side ones.

Everyone in this industry has spent two years arguing about whether guardrails accomplish anything or just annoy legitimate users. This is the first documented case of an attacker’s tool selection being visibly shaped by them. Ultimately the guardrails didn’t stop the campaign. They redirected it to a vendor that doesn’t have any. That’s a real outcome, and probably not the one anybody wanted.

The Setup

The stack is not exotic. That is precisely the point. Anyone reading this could assemble it this afternoon.

Hermes Agent, the open source framework from Nous Research, handled orchestration. Terminal access, a skills system, and Telegram as the command channel. VU covered Hermes Agent when it launched, and every capability being used here is a documented, advertised feature working exactly as designed.

DeepSeek sat underneath as the reasoning engine. It made the decisions: what to target, which exploit to use, when to give up.

Next, three custom skills. The bundled godmode jailbreak. A custom WebSocket exploitation skill. And a custom template teaching the agent to drive FOFA, an internet asset search engine, through the operator’s own Python script. He also plugged in an open source MCP server. It exposed FOFA search, Nuclei scan generation, and a DeepSeek powered translator turning plain English into FOFA queries.

Notably, that last piece deserves a beat. He built a natural language interface to a global asset scanner and handed the keys to a model.

One Message, Then Nothing

Unit 42 recovered a complete session from early May. They were unable to recover any operator input beyond the initial task.

What follows, then, is what the agent did by itself.

It picked a target class and failed

DeepSeek went after Langflow, an AI workflow tool, using CVE-2026-33017. CVSS 9.8. It downloaded the public proof of concept from GitHub, queried FOFA for live instances, found 84, ran the scanner across them with ten threads, and identified exactly one running a vulnerable version.

Then the exploit didn’t work. It needs either auto login enabled or a public flow ID, and the target had neither.

It made a business decision

This is where a script would have stopped. The agent instead assessed the entire product line as not worth its time, noting the deployments were small and the realistic exploitable count was probably zero, and went looking for something with more surface area.

It went shopping

DeepSeek surveyed deployment counts across ten product families through FOFA, then searched GitHub for trending 2026 CVE proof of concept repositories sorted by stars, weighing each candidate by severity, deployment footprint, and exploitability.

It settled on n8n. Its reasoning: a PoC with 258 stars and a CVSS of 10.0 looked promising, and the high star count suggested the flaw was already widely exploited.

Using GitHub stars as a proxy for exploit reliability is not a technique from any manual. It’s the kind of shortcut a person develops after a few years of doing this.

FOFA confirmed the pick: 647,017 n8n instances worldwide, 25,209 of them in China.

It read the advisories

The n8n exploit chains two vulnerabilities, an arbitrary file read at CVSS 10.0 and a sandbox bypass to remote code execution at 9.9. The agent pulled the version ranges from the advisories, worked out which builds were vulnerable to both, and started matching that against what it was finding in the wild.

If you run n8n, this is the moment to check your version. Both flaws are patched, in 1.121.0 and 1.120.4 respectively. Anyone still self hosting an older build is in the population this agent was enumerating. Our automation platform comparison covers where n8n fits against the hosted alternatives, and self hosting is exactly the tradeoff on display here.

It managed its own budget

Out of 25,209 exposed Chinese n8n instances, DeepSeek sampled about 100 addresses, probed roughly 40 of them with curl to check versions, and found three running vulnerable builds. Unit 42 assessed the narrowing as deliberate, likely to conserve compute.

Then it failed again

All three targets had authentication on their form endpoints, and the exploit requires an unauthenticated form with file upload. The agent checked, understood why it wouldn’t work, and moved on. It launched parallel scans across fifty more targets. None had exposed forms.

The session ends there. Nothing compromised.

The Failure Is Not the Reassuring Part

Zero successful autonomous compromises. That’s the headline number, and indeed it’s real.

Now read Unit 42’s explanation of why. Exploitation was prevented by target side configuration requirements, and targets with weaker default configurations would have been susceptible.

The agent didn’t lose to a firewall or an intrusion detection system or anyone noticing. It lost because two specific deployments happened to have a login prompt where the exploit needed an open form.

That’s the margin. Not defense in depth. Instead, a default setting.

What Unit 42 flags as significant is the process itself. It executed hundreds of hours of manual targeting analysis in minutes, while managing its own compute resources.

A human doing this work reads advisories, cross references versions, builds target lists, runs scanners. Then gets bored, gets distracted, gets it wrong. The agent did the full loop in one session with no supervision. It came up empty only because it happened to pick two products with reasonable defaults.

However, point it at a product family with sloppier defaults and the same session ends differently.

The Seven, and Which Ones Are Your Problem

Unit 42 documented seven vulnerabilities the operator had tooling for. None are new. Furthermore, all were public and all had patches available.

Incidentally, that last row is worth a moment. He pulled a public PAN-OS exploit off GitHub that turned out to be non functional, full of placeholder values that can’t achieve code execution. No evidence he modified or ran it. Even the guy with the autonomous attack pipeline downloads broken code off the internet sometimes.

Practical version for anyone self hosting: if you run Langflow, n8n, Marimo, or Tomcat on a public address, go check your versions today. The two n8n flaws are fixed in 1.121.0 and 1.120.4. Everything on this list has a patch, and the agent was hunting specifically for the people who hadn’t applied theirs.

Finally, notice what’s missing from the table. No zero days. Nothing bought, nothing discovered, nothing developed. The entire operation ran on other people’s published work against other people’s unpatched software.

Where the Real Damage Came From

Strip out the AI entirely and you still have a working criminal operation. Most of the coverage buried that.

Instead, the three confirmed compromises came from manual exploitation of a Citrix NetScaler out of bounds memory read. The operator dumped memory and searched the results for NetScaler authentication cookies, which is session hijacking. He hit a Malaysian government entity repeatedly across multiple days, tuning memory grooming parameters and maximum read attempts. Later he came back with proxy anonymization.

Alongside that, per BleepingComputer’s summary: confirmed command execution on eleven Marimo notebook instances. Java deserialization reverse shells attempted against nine Apache Tomcat servers. Reverse shell callbacks aimed at three IKE VPN endpoints.

Investigators also found evidence of batch exploitation against an unknown number of hosts. That list sat in a file the actor deleted before they arrived.

So the scoreboard reads: AI did the reconnaissance and got nowhere, human did the exploitation and got into three organizations. The persistent, targeted, patient work was all manual. The agent handled the volume.

That’s the current shape of AI assisted attack. Less cinematic than the headlines, but more useful to know.

Who He Is

Unit 42 places the operator in Zhuhai, in southern China. He works under the aliases knaithe and KnYuan, and describes himself as a binary security researcher.

Interestingly, the attribution came from his GitHub. He maintains a project called 1DayNews, an automated vulnerability intelligence pipeline. It aggregates remote code execution disclosures from 17 sources, mostly network perimeter vendors. Then it uses DeepSeek to filter them for exploitability and pushes alerts out over Telegram.

Now read that again with the campaign in mind. He built a system that watches for new vulnerabilities and uses AI to decide which are worth attacking. It notifies him on the same messaging platform he uses to command his attack agent.

Disclosure feed on one end, autonomous exploitation on the other, DeepSeek doing the thinking at both. That isn’t a hacker with an AI tool. It’s a pipeline with a person standing next to it.

His broader activity is opportunistic, with confirmed victims across three countries and multiple sectors. The autonomous campaigns hit Chinese domestic infrastructure indiscriminately. Only the Malaysian government target got sustained attention.

The Self Own

Back to the file server, because it’s the funniest thing in the report. It’s also the most instructive.

Hermes Agent, responding to a Telegram command, started an HTTP file server from the actor’s home directory instead of an isolated staging directory. That exposed the entire workspace.

Tool configurations. API keys. Exploit scripts. Target lists. Bash history. Finally, every autonomous session log.

Unit 42 notes the exposure was unintentional. The actor showed operational security awareness elsewhere, emptying exploit directories after use and disabling Codex conversation logging.

He was careful, generally. Proxies for the Western tools. Attribution headers switched off. Exploit directories wiped after every use.

Then he asked his agent to serve some files and it picked the wrong directory.

Unit 42’s conclusion: the same autonomous capability he built for offense directly caused the exposure. It produced forensic artifacts that manual execution would never have created.

An agent with terminal access and no supervision will occasionally do something catastrophically literal, though. Ask it to share files and it shares the files, all of them, from wherever it happens to be standing. It has no concept of which directory is the embarrassing one.

Likewise, anyone who has run an agent with real permissions has felt a smaller version of this. The distance between “run a web server here” and “publish my credentials” is one working directory. The model doesn’t know which side of that line it’s on unless somebody drew it.

If You Run Agents, This Is About You

Most readers will never touch these techniques. The failure mode is another matter.

Similarly, everything the operator built is available to anyone. Open source framework, public model API, exploit code from GitHub, an asset search engine with a free tier. Overall the cost is a few dollars in tokens. Unit 42’s closing assessment is that the technical barrier to AI augmented offensive operations is low and continues to decrease.

Consequently the defensive lesson runs in both directions.

So if you self host anything on the open internet, the exposure window just collapsed. This agent went from “new CVE published” to “scanning global instances for vulnerable versions” inside one session. Patch timelines assuming attackers need days to weaponize a disclosure now rest on something false. Notably, both n8n flaws here were patched. Everything the agent looked for was already fixed, months earlier, by someone who published an advisory that nobody read.

If you run agents yourself, the working directory problem is your problem too. Yolo mode, dangerous skip permissions, whatever your framework calls it. The moment an agent has terminal access without approval prompts, its blast radius is every file it can reach. So use containers with explicit mounts and scoped API keys. Never run an agent from a directory holding anything you’d mind publishing. The OpenClaw guide walks through that setup for a local assistant, and the reasoning is identical at any scale.

And if you thought provider safety controls were theater, this is the first hard evidence they cost attackers something. Not much. But something, measured in a documented decision to go elsewhere.

The Third Agent Story in Two Weeks

Meanwhile, this lands in a run of them.

Nine days before this report, OpenAI disclosed a sandbox escape. Two of its models got into Hugging Face’s production systems while trying to cheat a benchmark. Then Anthropic disclosed three of its own models breaching real companies after a misconfigured evaluation environment left them connected to the open internet.

Both of those, though, were accidents inside labs that were trying to be careful.

This one was on purpose, by someone who wasn’t careful at all. Yet the shape is identical in all three. An agent with an open ended goal, more access than anyone intended, working a problem with nobody watching. Two of those cases were the safest environments in the industry. The third was a guy in Zhuhai with a Telegram bot.

So: same failure mode, wildly different levels of care. That’s not a coincidence, it’s a property of the tool.

The Part Worth Keeping

The autonomous attacks all failed. Nothing, in the end, got compromised by the machine.

Nevertheless, the machine picked its own targets and abandoned a dead end on its own judgment. It researched replacements by reading GitHub star counts, parsed security advisories for version numbers, rationed its own compute, and quit when the math stopped working. Nobody told it to do any of that after the first message, either.

It failed because two products it happened to choose ship with authentication on by default. That’s all.

In short, that’s the whole defense. Not detection, not response, not anything anyone built on purpose. Just a sensible default on someone else’s software, holding a line that nothing else was holding.

Charts and Blocks

Chart 1: The autonomous funnel

Block 2: Autonomous versus manual scoreboard

FAQ