Palo Alto Networks’ Unit 42 researchers have identified a Chinese-speaking threat actor using the DeepSeek AI model with the open-source Hermes Agent framework to autonomously scan, exploit and compromise vulnerable internet-facing servers with limited human involvement.
The activity was uncovered after the attacker’s AI agent accidentally exposed its own infrastructure, revealing API keys, exploit scripts, target lists and attack logs.
According to the researchers, the AI agent operated in an autonomous “Yolo” mode that allowed it to execute commands without requiring operator approval. The system was used to identify vulnerable targets, launch exploits and automate post-exploitation tasks.
Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs Had This To Say:
“Unit 42 caught this campaign because the AI agent accidentally started a file server from the attacker’s home directory and exposed everything. API keys, exploit scripts, target lists, session logs. The competent campaigns don’t self-expose.
“This was an unsophisticated operator with poor operational security. No zero-day discovery, no zero-day deployment. Every exploit was a public proof-of-concept pulled from GitHub for known Common Vulnerabilities and Exposures (CVEs).
“The entire stack was off-the-shelf, with DeepSeek as the reasoning engine, Hermes Agent for orchestration, and FOFA, a Chinese internet asset search engine similar to Shodan, connected through a Model Context Protocol (MCP) server. In one session with no further human input, the agent surveyed deployment counts across ten product families, selected the highest-value CVE by severity score and target volume, downloaded the exploit code, and started scanning.
“A single operator in Zhuhai attempted exploitation against over 460 systems across seven CVEs. The autonomous portion failed because target-side configurations happened to block the exploit chain. Happened to. A slightly less secure default on those n8n workflow automation instances and this would be a breach disclosure, not a research paper.
“That’s the unsophisticated version with commodity tooling and public exploits. A more capable threat actor running this same workflow discovers and deploys zero-days autonomously, without a human ever reviewing the exploit chain. When that capability intersects with ICS environments, the consequences shift from data theft to physical damage.
“I’ve built a Shodan MCP integration in about 30 minutes with an AI coding agent, and industrial control system (ICS) protocol MCP servers in a couple of hours. The attacker used a jailbroken DeepSeek instance, but they didn’t need to. I run Opus 4.6 for offensive security work, and it doesn’t stop you. The older and even open-source models are plenty strong with a solid harness around them. The barrier to autonomous hacking at scale is an afternoon and an API key or a decent GPU.
“This campaign burned through public CVEs with off-the-shelf tooling and still nearly succeeded. The next iteration finds zero-days on its own. Every quarter these models get more capable and cheaper to run. Organizations that aren’t aggressively shrinking their external attack surface and investing in detection and incident response now are going to learn that from an autonomous agent instead of a research paper.”
If I were you, I would look to see if you are a potential target. Because if you don’t, your adversaries will.
Related
This entry was posted on August 3, 2026 at 3:33 pm and is filed under Commentary with tags Palo Alto Networks. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Researchers find hacker using DeepSeek AI to automate cyberattacks
Palo Alto Networks’ Unit 42 researchers have identified a Chinese-speaking threat actor using the DeepSeek AI model with the open-source Hermes Agent framework to autonomously scan, exploit and compromise vulnerable internet-facing servers with limited human involvement.
The activity was uncovered after the attacker’s AI agent accidentally exposed its own infrastructure, revealing API keys, exploit scripts, target lists and attack logs.
According to the researchers, the AI agent operated in an autonomous “Yolo” mode that allowed it to execute commands without requiring operator approval. The system was used to identify vulnerable targets, launch exploits and automate post-exploitation tasks.
Jacob Krell, Senior Director: Secure AI Solutions & Cybersecurity, Suzu Labs Had This To Say:
“Unit 42 caught this campaign because the AI agent accidentally started a file server from the attacker’s home directory and exposed everything. API keys, exploit scripts, target lists, session logs. The competent campaigns don’t self-expose.
“This was an unsophisticated operator with poor operational security. No zero-day discovery, no zero-day deployment. Every exploit was a public proof-of-concept pulled from GitHub for known Common Vulnerabilities and Exposures (CVEs).
“The entire stack was off-the-shelf, with DeepSeek as the reasoning engine, Hermes Agent for orchestration, and FOFA, a Chinese internet asset search engine similar to Shodan, connected through a Model Context Protocol (MCP) server. In one session with no further human input, the agent surveyed deployment counts across ten product families, selected the highest-value CVE by severity score and target volume, downloaded the exploit code, and started scanning.
“A single operator in Zhuhai attempted exploitation against over 460 systems across seven CVEs. The autonomous portion failed because target-side configurations happened to block the exploit chain. Happened to. A slightly less secure default on those n8n workflow automation instances and this would be a breach disclosure, not a research paper.
“That’s the unsophisticated version with commodity tooling and public exploits. A more capable threat actor running this same workflow discovers and deploys zero-days autonomously, without a human ever reviewing the exploit chain. When that capability intersects with ICS environments, the consequences shift from data theft to physical damage.
“I’ve built a Shodan MCP integration in about 30 minutes with an AI coding agent, and industrial control system (ICS) protocol MCP servers in a couple of hours. The attacker used a jailbroken DeepSeek instance, but they didn’t need to. I run Opus 4.6 for offensive security work, and it doesn’t stop you. The older and even open-source models are plenty strong with a solid harness around them. The barrier to autonomous hacking at scale is an afternoon and an API key or a decent GPU.
“This campaign burned through public CVEs with off-the-shelf tooling and still nearly succeeded. The next iteration finds zero-days on its own. Every quarter these models get more capable and cheaper to run. Organizations that aren’t aggressively shrinking their external attack surface and investing in detection and incident response now are going to learn that from an autonomous agent instead of a research paper.”
If I were you, I would look to see if you are a potential target. Because if you don’t, your adversaries will.
Share this:
Like this:
Related
This entry was posted on August 3, 2026 at 3:33 pm and is filed under Commentary with tags Palo Alto Networks. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.