Giving an AI access to a computer is one thing. But giving it the keys to an active cyberattack is another.
In a campaign uncovered by Palo Alto Networks’ Unit 42, a threat actor did exactly that, allowing DeepSeek to investigate targets, find vulnerabilities, obtain exploit code and attempt attacks with almost no human input..
The operation was uncovered only after the agent accidentally exposed the attacker’s entire working environment, including API keys, exploit scripts, target lists, and attack logs.
Unit 42 found that the attacker was using DeepSeek through the open-source Hermes Agent framework. The setup allowed the AI to search for vulnerable systems, assess targets, find public exploit code and launch attacks without waiting for the operator to approve each step.
The campaign shows how AI agents can now connect several parts of a cyberattack into a largely automated process.
DeepSeek Was Running the Attack
The threat actor, who used the aliases knaithe and KnYuan, configured Hermes Agent as the main offensive tool and used DeepSeek as its reasoning engine.
Hermes gave the model access to a terminal, internet connectivity, and Telegram-based command and control. The attacker also added custom skills that allowed the system to search FOFA for internet-exposed assets and perform offensive security tasks.
Additionally, Unit 42 recovered a May 7, 2026 session where researchers could not find additional instructions from the operator after the initial task. From there, DeepSeek independently investigated targets and vulnerabilities.
It first looked at exposed Langflow servers and found 84 instances through FOFA. After its initial exploitation attempt failed, the model decided the targets were not valuable enough and searched for other vulnerabilities.
It then identified n8n, a workflow automation platform, as a more attractive target. FOFA showed more than 647,000 n8n instances globally, and DeepSeek obtained public proof-of-concept code for two vulnerabilities and checked exposed systems for versions that could potentially be exploited.
The attacks against Langflow and n8n ultimately failed because the exposed systems did not meet the conditions required by the exploits. However, Unit 42 said the campaign demonstrated a functional end-to-end autonomous offensive workflow.
The AI Gave Away the Operation
The discovery happened because Hermes made a basic operational mistake.
In response to a Telegram command, the agent started a Python HTTP file server from the attacker’s home directory instead of an isolated working folder. This was what exposed the entire directory to researchers.
The exposed files contained AI tool configurations, API keys, exploit scripts, target lists, Bash history, and Hermes’ autonomous attack logs.
And the mistake was particularly damaging because the attacker had taken other steps to hide their activity, because Unit 42 found that exploit directories had been emptied after use and some AI conversation logging had been disabled.
DeepSeek Was Not the First Choice
The attacker also tested other AI tools before settling on DeepSeek. Unit 42 found evidence of limited use of Claude Code and OpenAI’s Codex during the campaign.
Claude Code was used for connectivity and proxy testing, while signs of Codex activity appeared in exploit development directories. The attacker routed both tools through a third-party proxy and configured them to reduce local traces.
OpenAI later confirmed to Unit 42 that its provider-side safeguards had rejected requests that violated its policies. Continued attempts also triggered OpenAI’s safety systems to flag and disable an account believed to be linked to the campaign.
This helped shape the attacker’s choice of DeepSeek. Unit 42 said the actor appeared to select a model with fewer safety controls after provider-side restrictions on Western AI tools limited their usefulness for autonomous offensive work. It then makes sense that DeepSeek was accessed directly through its API and run through Hermes Agent, an open-source framework with no built-in safety layer.
AI Did Not Cause the Entire Campaign
The campaign also included manual hacking activity separate from the DeepSeek-driven operation, with Unit 42 finding confirmed data theft from three organisations through a Citrix NetScaler vulnerability and confirmed command execution on 11 Marimo notebook instances.
This distinction matters because the DeepSeek-powered attacks themselves did not successfully compromise the Langflow and n8n targets examined by researchers.
Still, the operation demonstrates how little human involvement can be required for an AI system to carry out complex offensive security work.
