Unit 42 uncovered an AI-driven Chinese hacking campaign where DeepSeek autonomously scanned targets, selected exploits, and launched attacks.
Researchers at Palo Alto’s Unit 42 got a front-row seat to something they’d only theorized about before: an AI system running an actual hacking campaign with almost no human steering it. The researchers spotted a Chinese-speaking actor, going by the handles knaithe and KnYuan, who wired DeepSeek into an open-source framework called Hermes Agent and let it hunt for vulnerable targets, find exploit code, and launch attacks on its own.
The researchers only saw any of this because the attacker made one careless mistake.
That mistake was starting a file server in the operation’s home directory instead of an isolated staging folder. It exposed everything: API keys, exploit scripts, target lists, bash history, and full session logs of the AI actually doing the work.
Unit 42 essentially got to watch the attacker’s screen after the fact.
DeepSeek wasn’t the only AI in play. The actor also tested Qwen, GLM, Kimi, and MiniMax, and even poked at two Western tools, Claude Code and Codex, though only in a limited, exploratory way. Claude Code got ten total interactions across three sessions, mostly connectivity checks; Codex’s actual use couldn’t be confirmed because the attacker had disabled its conversation logging.
“In parallel with their use of DeepSeek as their autonomous operator platform, the actor configured multiple large language models (LLMs) (Qwen, GLM, Kimi, MiniMax). We also identified limited usage and testing of Western platforms. This includes Claude Code for connectivity testing and proxy validation.” reads the report published by Unit 42. “There were also signs of usage of Codex on exploit development directories. This limited usage is consistent with evaluating the AI-market to identify their preferred tool set.”
The tool configuration says a lot about intent. Both Western tools got routed through a third-party proxy to hide the connection, with attribution headers stripped and non-essential traffic disabled. DeepSeek and Qwen, by contrast, connected straight to their native APIs with no such precautions, which tells you which tool the attacker actually trusted for the job.
“DeepSeek, operating through the Hermes Agent framework, served as the actor’s primary offensive AI tool. Hermes Agent provided orchestration (terminal access, Telegram-based command and control, and the skills system) while DeepSeek served as the reasoning engine for code generation, vulnerability assessment, target selection and decision-making.” continues the report.
“The actor had customized Hermes Agent with three red-teaming skills:
- fofa-cyberspace-search: a custom procedure template instructing DeepSeek to use the actor’s fofoapi.py script for internet asset enumeration”
- godmode: LLM jailbreaking, framework-bundled
- web-terminal-exploitation: unauthenticated WebSocket exploitation, custom-created”
Watching DeepSeek work through an actual attack chain is the most striking part of the report. It found a Langflow vulnerability (CVE-2026-33017), downloaded a public proof-of-concept, scanned for 84 live instances, and hit a wall: every target needed either a public flow ID or a login setting the attacker didn’t have access to. Rather than giving up, DeepSeek talked itself through the dead end and moved on, reasoning in real time that the deployment base was too small to bother with and it should look for something bigger.
That reasoning led it to n8n, a workflow automation tool with a proof-of-concept exploit that had racked up far more attention on GitHub than Langflow’s had. FOFA scans confirmed the instinct: over 647,000 n8n instances existed worldwide, more than 25,000 of them in China. DeepSeek chained two separate vulnerabilities together, worked out exactly which version range was exploitable, then ran headfirst into the same kind of wall as before, every accessible form endpoint it found required authentication it didn’t have.
The AI never fully broke in anywhere during these autonomous runs. But it sampled roughly 100 IP addresses out of that 25,000-plus n8n population, actively probed around 40 of them for version details, and found three vulnerable systems, compressing what Unit 42 says would normally take a human hours to do into a handful of minutes. “the system executed hundreds of hours of manual targeting analysis in mere minutes”, and that’s the number that should worry defenders more than any single failed exploit.
“While most of the systems were unreachable or non-responsive, DeepSeek found three with the vulnerable versions and attempted to exploit them automatically. This autonomous process of target identification, sampling and narrowing of scope is notable because the system executed hundreds of hours of manual targeting analysis in mere minutes, while also managing its own compute resources.” continues the report. “Across all the exploitation attempts, both autonomous and manual, Unit 42 confirmed data exfiltration from three Citrix NetScaler targets (CVE-2026-3055) and command execution on 11 Marimo notebook endpoints (CVE-2026-39987). “
While the AI chased those two failures, the same actor was busy elsewhere doing old-fashioned manual hacking that actually worked. They pulled data out of three organizations through a Citrix NetScaler flaw, got command execution running on eleven Marimo notebook instances, and attempted reverse shells against Apache Tomcat servers and Windows IKE VPN endpoints. One target, a government body in Malaysia, got hit repeatedly over multiple days with increasingly careful technique and proxy anonymization layered in on later attempts, a level of patience the fully-automated runs never showed.
Unit 42 traces the actor back to Zhuhai, China, partly through a side project on GitHub: an automated tool that scrapes seventeen sources for newly disclosed remote-code-execution bugs, uses DeepSeek to sort which ones are actually exploitable, and pushes alerts out over Telegram. That’s a hacker who’s already comfortable outsourcing judgment calls to a language model well before this campaign started.
Nothing here fully succeeded, and that’s exactly the point researchers are making. The only thing standing between working exploits and failed ones was target-side configuration that happened to be tighter than average, not any weakness in the attacker’s approach. Build your systems with the defaults this campaign got blocked by, because the AI running the offense clearly isn’t going to be the bottleneck for much longer.
“Our findings document a threat actor developing AI-augmented offensive capabilities that enabled them to dramatically increase the speed and scale of their campaigns.” concludes the report. “This research validates an emerging threat posed by AI-enabled attackers as they hone their autonomous attack processes to discover, assess, pivot and retarget without human intervention.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, AI)
