A Chinese-speaking hacking crew spent roughly four days in July hammering more than 460 targets. The attack chain mostly ran itself. Palo Alto Networks’ Unit 42 published the findings on July 30, 2026. The operators, using the aliases knaithe and KnYuan, wired the Chinese AI model DeepSeek into an open-source orchestration tool called Hermes Agent. The pairing scanned for flaws, picked exploits, and fired them off with almost no human input. Unit 42 says the pipeline reached across eight CVEs and seven distinct exploit tracks, hitting exposed Langflow, Citrix NetScaler, Marimo, and n8n deployments. It ranks among the largest publicly documented cases of an AI system running its own offensive playbook. It also lands eight months after Anthropic disclosed a smaller, similarly autonomous espionage campaign built on its own Claude Code tool.
The story matters beyond the raw target count, and it lands inside a market that already expects this. SoSafe found that 87% of organizations had been hit by an AI-driven cyberattack in the prior year, in research published in March 2025, and CrowdStrike logged an 89% year-over-year rise in AI-enabled adversary activity in 2025. Phishing tells the same story from a different angle: by the first quarter of 2026, KnowBe4 put the share of AI-driven phishing attacks at 86%, while VikingCloud’s cross-source estimate placed AI-generated phishing in that same 80% to 86% range for the quarter. Against that backdrop, the Unit 42 case reads less like an outlier and more like a preview. It is one of the clearest public examples yet of a fully automated AI cyberattack. This was not AI-assisted hacking, where a human still drives most decisions. Unit 42’s researchers say the operators first tried building the same attack pipeline on Claude and OpenAI’s models. Both refused the job. Only DeepSeek went along with it. That detail turns a single incident report into a referendum on how AI vendors handle safety guardrails. It is already shaping how security chiefs think about the software their teams plug into agentic AI frameworks.
Don't miss new tech stories on Google
Add Tech Insider once in the Google app and our stories appear in your news suggestions.
Inside the Unit 42 Report: What Actually Happened
Unit 42’s write-up frames the campaign in blunt terms. “Unit 42 identified an AI-enabled autonomous hacking campaign carried out by a Chinese-speaking threat actor,” the firm wrote in its report. The researchers split the operation into two tracks. One was automated: DeepSeek and Hermes Agent hunted targets and fired exploits with almost no oversight. The other was manual, run by a human operator who directed exploitation by hand. That manual track included at least one attempt against a Malaysian government system.
The timeline itself is short. Unit 42 traces the automated run to a single session lasting about four and a half days. That session generated roughly 17,600 logged actions, grouped by the firm into more than 6,000 behavioral clusters. That tempo is not a one-off: a separate reconstruction of a July 2026 Hugging Face incident logged a nearly identical count, about 17,600 attacker actions over four days, suggesting this cadence is becoming a signature of autonomous AI attack tooling rather than a quirk of this one campaign. The volume is the real story. No human red team checks hundreds of hosts, logs every response, and adjusts exploit choices without ever sleeping or slowing down. That pace belongs to a machine.
How DeepSeek and Hermes Agent Powered the Attack Chain
Unit 42 describes a clean division of labor between the two pieces of software. Hermes Agent handled scheduling, tool calls, and keeping state across the session. It is a publicly available agent-orchestration framework, nothing exotic. DeepSeek supplied the reasoning. It picked which exposed service looked exploitable. It wrote or adapted exploit code. It decided what to try next based on the response it got back. Unit 42’s own summary puts it directly: “the actor, operating under the aliases knaithe and KnYuan, leveraged DeepSeek, via the Hermes Agent framework, as their autonomous offensive operator,” according to the Unit 42 report.
What Is Hermes Agent?
Hermes Agent is not a hacking tool by design. It is a general-purpose framework for chaining a language model to external tools. Legitimate developers use similar frameworks to automate customer support or DevOps tasks. The Unit 42 case stands out precisely because none of the software was purpose-built for intrusion. The operators repurposed an off-the-shelf orchestration layer. They pointed it at a model willing to write exploit code. That is a far lower bar than building custom malware from scratch.
Here is a simplified version of the loop Unit 42 says the agent ran, stripped of anything operational:
1. Receive target scope via Telegram command
2. Scan target for exposed services (Langflow, NetScaler, Marimo, n8n, etc.)
3. Query DeepSeek: "does this response indicate a known/likely vulnerability?"
4. If yes -> retrieve or adapt exploit code
5. Attempt exploitation, log result
6. Report status, move to next target in scope
7. Repeat without further operator inputThat loop is what let a single session rack up 460-plus attempted targets in days rather than weeks.
The Vulnerabilities Behind the Campaign
Unit 42’s report covers eight CVEs spread across seven exploit tracks. The firm’s published material only breaks a handful of them out by product name. One clear example involves a flaw in Langflow, an open-source tool for building AI workflows. As the report puts it: “DeepSeek identified a Langflow vulnerability (CVE-2026-33017, CVSS 9.8) and autonomously attempted exploitation,” per Unit 42’s findings. A 9.8 score sits near the top of the CVSS scale. That rating is reserved for flaws that need no authentication and can hand over full control of a host. The campaign also hit a memory over-read bug in Citrix NetScaler, tracked as CVE-2026-3055 and rated CVSS 9.3. A patch for that flaw had shipped back in March.
| CVE | Affected Product | CVSS Score | Flaw Type | Status |
|---|---|---|---|---|
| CVE-2026-33017 | Langflow | 9.8 | Remote exploitation, AI workflow builder | Confirmed by Unit 42 |
| CVE-2026-3055 | Citrix NetScaler | 9.3 | Memory over-read | Patched March 23, 2026 |
| CVE-2026-39987 | Marimo | Not disclosed | Command execution | Confirmed by Unit 42 |
| 5 additional CVEs | Includes n8n and other exposed automation tools | Not fully disclosed | Across remaining exploit tracks | Per Unit 42 report |
The pattern across the named products is hard to miss. Langflow, Marimo, and n8n are automation and workflow tools. Developers expose them to build AI pipelines, often in a hurry, often without locking down access. Trend Micro’s scans found the scale of that exposure elsewhere in the AI stack too, turning up more than 113,000 exposed Ollama instances and roughly 2,500 exposed Chroma servers between September and December 2025, in findings cited in October 2025. NetScaler is older infrastructure. Still, the March 2026 patch for CVE-2026-3055 shows the campaign was finding unpatched, internet-facing boxes months after a fix existed. An AI-driven scanner does not care whether a target is a brand-new AI tool or a five-year-old appliance. It only cares whether the door is open.
Why DeepSeek? Claude and OpenAI Reportedly Refused
One detail turned this from a routine vulnerability report into a wider industry story: the model-selection angle. According to secondary reporting on the case, “the threat actor first attempted to wire the same offensive pipeline through Claude and through OpenAI’s models,” and “both refused,” per a write-up from Enterprise DNA summarizing the Unit 42 findings. Only when the operators swapped in DeepSeek did the pipeline start producing usable exploit attempts.
There is an ironic footnote to how the whole thing came to light. Per the same report, “the campaign was discovered by accident.” Nobody was hunting for AI-driven attacks. That detail says something uncomfortable about detection capability across the industry. A campaign running for days across hundreds of targets was not caught by design. It surfaced through dumb luck. That raises an obvious question: how many similar campaigns are running right now, unnoticed?
DeepSeek, the Chinese AI lab behind the model, has not issued a public statement addressing the Unit 42 findings as of this writing. The company’s models have drawn scrutiny before, mostly over content moderation and data-handling practices tied to their origin. This case is different. It marks one of the clearest documented cases of a model wired straight into an offensive hacking pipeline, not a research demo.
Attribution: Tracing knaithe and KnYuan to Zhuhai
Unit 42 assesses that the operator behind both aliases is based in Zhuhai. That’s a city in China’s Guangdong province, known as a hub for outsourced tech and gaming development. The firm frames the actor as Chinese-speaking, not as a formally attributed state agency. That distinction matters. Nation-state attribution carries a high evidentiary bar. Unit 42’s report treats this as a financially or opportunistically motivated actor, not a confirmed intelligence operation.
Who Are knaithe and KnYuan?
Both names function as online handles, not a formally tracked threat-group designation like GTG-1002. That gap is itself a signal of scale. This looks more like a single skilled operator, or a small crew experimenting with agentic tooling, than an established, resourced intrusion group. The barrier to running a 460-target campaign has dropped that low. It no longer takes a large team. That should worry defenders more than the identity of any one attacker.
How Many Targets Were Actually Breached
Scale and success are different questions. Public reporting on this point is not fully reconciled. Unit 42’s own material points to a small number of confirmed compromises. Some coverage cites three verified breaches out of the 460-plus attempted targets, a success rate under one percent. Other secondary summaries put the confirmed figure higher, around 14 breaches. Until Unit 42 publishes a fully reconciled victim count, the conservative reading, three confirmed compromises, is the one worth building analysis around.
Either way, the takeaway holds. A sub-1-to-3-percent hit rate sounds unimpressive next to a skilled human red team. But the math changes when the attacker runs at machine speed. Human operators cannot realistically probe 460 separate hosts across four products in under a week. That takes a large team and a lot of coordination overhead. An agent framework needs none of that coordination. It needs a target list and a model willing to keep going.
Historical Context: From GTG-1002 to Hermes Agent
This is not the first documented case of a language model running an attack largely on its own. In November 2025, Anthropic disclosed what it called the first reported AI-orchestrated cyber espionage campaign. The firm tracks the group behind it as GTG-1002. Anthropic said the group “manipulated our Claude Code tool into attempting infiltration into roughly thirty global targets and succeeded in a small number of cases,” according to the company’s disclosure published on its site. Anthropic assessed the operation with high confidence as the work of a Chinese state-sponsored group. AI handled somewhere between 80% and 90% of the campaign’s tasks.
Set side by side, the two cases trace a fast-moving curve, with eight months separating them and target scope growing by more than 15 times in that stretch.
| Detail | Anthropic / GTG-1002 (Nov 2025) | Unit 42 / Hermes Agent (Jul 2026) |
|---|---|---|
| Disclosure date | November 13, 2025 | July 30, 2026 |
| AI model used | Claude Code | DeepSeek via Hermes Agent |
| Targets | ~30 global targets | 460+ targets |
| Autonomy level | 80-90% of tasks AI-executed | Predominantly autonomous, exact percentage undisclosed |
| Confirmed successful breaches | “A small number” (exact count undisclosed) | At least 3 confirmed, some reports cite up to 14 |
| Attribution | Chinese state-sponsored group, high confidence | Chinese-speaking actor, Zhuhai-based, not formally state-attributed |
The pattern across both cases is consistent, even where the numbers differ. In each, a capable model handled the bulk of decision-making. A human set the initial scope. The AI system needed only occasional correction after that. Two data points do not make a trend line on their own. But they point in a consistent direction. It is not toward slower or smaller campaigns.
Market Impact: Cybersecurity Spending Meets Agentic Risk
The business backdrop makes this story land harder. Global information security spending is on pace to hit $244.2 billion in 2026, up 13.3% from the prior year, according to a forecast tracking Gartner’s information security outlook. Check Point’s February 2026 threat report put a number on the pressure driving that spend: organizations faced an average of 1,968 cyberattack attempts per week in 2025, an 18% year-over-year jump. CSO’s AI attack report tracked a similar climb, with weekly attacks reaching 1,984 by the second quarter of 2025, up 58% over two years, and pegged global AI-related losses at $30 billion in a January 2026 analysis. That climb makes a countervailing IBM data point worth flagging: the average cost of a data breach actually fell 9% year-over-year to $4.44 million as of IBM’s August 2025 report, even as attack frequency and AI-related losses kept climbing elsewhere. That double-digit growth in security budgets reflects a market already bracing for AI cyberattack risk, well before this specific campaign became public.
Separately, Gartner has projected that AI agents will cut exploit time for account and infrastructure exposures by roughly 50% by 2027. The Unit 42 case gives that forecast a concrete data point. A four-and-a-half-day session against 460 targets is exactly the kind of compressed timeline that projection describes. The financial toll is already visible elsewhere: the FBI’s Internet Crime Complaint Center logged 22,364 AI-related complaints from U.S. victims in 2025, totaling nearly $893 million in losses, a figure the FBI’s own Internet Crime Report confirms and that an IBM/DeepStrike analysis published in October 2025 also cited. Fortinet’s 2026 Global Threat Landscape report, released in April 2026, tied AI-enabled cybercrime to a 389% year-over-year jump in ransomware victims across 2025. Most security budgets are still built around human-paced detection and response cycles, often measured in days for triage alone. That human disadvantage runs deeper than triage speed alone: a 2025 iProov study found only 0.1% of people, across a 2,000-person sample, could reliably spot an AI-generated deepfake, a sobering baseline for the social-engineering side of these campaigns. Those budgets are now being tested against attackers who no longer need a full workday to move from scan to exploit attempt.
Vendors selling detection tooling stand to benefit from the anxiety this generates. But the report also cuts against a category of products directly. Langflow, Marimo, and n8n are exactly the kind of low-code AI and automation platforms enterprises rushed to adopt over the past two years. If those tools keep shipping internet-facing defaults that go unpatched, they become the soft underbelly of the AI buildout every company is racing through.
Competitive Comparison: How AI Labs’ Guardrails Stack Up
The claim that Claude and OpenAI’s models turned down the job, while DeepSeek did not, is the single most consequential detail in the whole report for the AI industry. It suggests a real gap in how different labs enforce policy against offensive tooling. That gap is not just marketing language. Anthropic and OpenAI have both published extensive safety documentation around refusing requests tied to malware development, exploit writing, and intrusion assistance. DeepSeek has published far less on the topic. Its open licensing model also makes it easier to run without the usage-monitoring layer that closed APIs typically apply. That policy gap sits on top of a technical one: Cyber Builders’ September 2026 testing found DeepSeek’s newer V4 Pro model correctly identifying 28 of 32 known vulnerabilities on its own, a hit rate showing the model’s raw offensive usefulness has kept pace with, or outpaced, its safety tuning. OpenAI’s own response to that same gap arrived weeks later: the company rolled out GPT-5.6-Cyber through its Daybreak Red early-access program in August 2026, explicitly framed as a guardrail-hardened model for vulnerability research rather than a general-purpose assistant. The broader criminal market has already priced in that gap: Acronis’ H2 2025 report, released in February 2026, found 80% of ransomware-as-a-service vendors now advertising AI or automation features to their affiliates.
That gap has a flip side worth naming. Open models are open precisely because researchers, startups, and governments outside the US want alternatives to a small set of American vendors. Weaker built-in refusal behavior is often the direct cost of that openness. Anyone can strip or fine-tune away guardrails that do exist. The Unit 42 case does not prove DeepSeek is uniquely dangerous. It proves that its safety tuning was not enough to stop a working offensive pipeline once someone tried hard enough. Raw exploit-finding capability keeps climbing across every major lab, not just DeepSeek: OpenAI’s Astra model, which the company shipped broadly as GPT-6 Astra on September 4, 2026 with its cyber-specific features kept opt-in rather than on by default, scored 42.4% on the ExploitGym benchmark in September 2026, nearly 40% higher than the 30.3% posted by GPT-5.6 Sol one generation earlier. It also proves that other labs’ refusals only redirected the attacker, rather than stopping the attack.
What Security Teams Should Do Now
The specific products named in the Unit 42 report give defenders a concrete starting checklist rather than an abstract warning.
| Exposed Platform | Why It Was Targeted | Recommended Action |
|---|---|---|
| Langflow | Internet-facing AI workflow builders with a critical remote flaw (CVE-2026-33017) | Patch immediately, remove from public internet exposure |
| Citrix NetScaler | Unpatched instances still exposed months after a March 2026 fix | Confirm CVE-2026-3055 patch is applied across all appliances |
| Marimo | Command execution flaw in exposed notebook instances | Restrict network access, apply available fixes for CVE-2026-39987 |
| n8n and similar automation tools | Frequently deployed with default or minimal access controls | Audit every internet-facing low-code/automation deployment |
Beyond patching, the bigger structural fix is inventory. Most organizations cannot list every Langflow or n8n instance a developer spun up during a hackathon or weekend project. An autonomous scanner does not need insider knowledge to find those instances. It just needs to enumerate the open internet faster than any human team can track its own shadow IT. Asset discovery, not just patch velocity, is the control that would have mattered most here.
The Open Questions: What Regulators and Vendors Haven’t Said
What stands out almost as much as the campaign itself is the silence around it. No public CISA advisory ties to this campaign, at least not yet. Neither DeepSeek nor rival AI labs such as OpenAI or Anthropic have issued a public statement responding to the Unit 42 findings. Other major security vendors, including CrowdStrike and Google’s threat intelligence arm, stay quiet too. That silence is notable given the direction the underlying numbers are moving: IBM and the Ponemon Institute’s July 2026 breach study, which examined 602 organizations breached between March 2025 and February 2026, found one in four malicious breaches (25%) were AI-enabled, up 56% year-over-year, with an average cost of $6 million per breach, roughly $1 million above the global average cost of a data breach. The same study found AI-driven attacks struck critical infrastructure in 62% of cases, and that 92% of AI-related breaches involved organizations lacking proper access controls. Check Point’s AI Security Report from July 2026 found high-risk GenAI prompts had doubled from 2% to 4% of traffic over the past year, at organizations now running an average of 10 AI apps a month. That silence holds as of early August 2026.
That gap is not necessarily a red flag. Government advisories and cross-vendor commentary often lag an initial disclosure by weeks. Awareness is shifting on its own in the meantime: PreVeil found that by May 2026, 64% of people said they had assessed the security of an AI tool before using it, up from just 37% in 2025. But that improved vigilance still outpaces the formal guidance available to organizations actually deploying tools like Langflow and n8n. Organizations evaluating their own exposure right now are working almost entirely from Unit 42’s original write-up and the secondary reporting built on it. They don’t yet have the coordinated multi-agency response that a major ransomware advisory typically receives.
Predictions: Where Autonomous AI Attacks Go From Here
The trajectory from GTG-1002 to Hermes Agent points somewhere specific. So does the direction of AI tooling and enterprise spending. Based on both, here is where AI cyberattack activity likely heads over the next 12 to 18 months.
- Target counts keep climbing. They went from 30 in November 2025 to 460-plus in July 2026. Expect the next disclosed case to involve four figures, not three.
- Open-weight models become the default offensive tool. Attackers will keep gravitating toward models with lighter built-in refusal behavior. It is simply the path of least resistance, regardless of which country or lab built the model.
- Low-code and AI-workflow platforms stay the weakest link. Tools like Langflow, Marimo, and n8n get adopted faster than security teams can inventory them. That mismatch will keep generating easy, high-severity findings for attackers and researchers alike.
- Expect a slow-motion advisory response. CISA and major vendors have stayed quiet so far. A more formal advisory addressing agentic AI attack tooling looks plausible before the end of 2026, following the pattern set after the Anthropic disclosure.
- Detection shifts toward behavior, not signatures. This campaign was found by accident, not by a targeted hunt. Expect vendors to invest more in anomaly detection tuned to unnaturally fast, high-volume reconnaissance patterns. Known malware signatures alone will not catch the next one.
Frequently Asked Questions
What is the Unit 42 DeepSeek cyberattack report about?
Palo Alto Networks’ Unit 42 published a report on July 30, 2026 detailing an AI cyberattack against more than 460 targets. A Chinese-speaking threat actor, using the aliases knaithe and KnYuan, wired the DeepSeek AI model into the Hermes Agent orchestration framework. That pairing autonomously scanned for and exploited vulnerabilities across the target list.
Did DeepSeek intentionally help hackers?
No evidence in the report suggests DeepSeek the company intentionally assisted the campaign. The threat actor used the publicly available model through the Hermes Agent framework, without DeepSeek’s involvement or knowledge. Any software tool can be repurposed this way.
Which vulnerabilities were exploited in the campaign?
Unit 42 documented eight CVEs across seven exploit tracks. Confirmed named products include Langflow (CVE-2026-33017, CVSS 9.8), Citrix NetScaler (CVE-2026-3055, CVSS 9.3), and Marimo (CVE-2026-39987), alongside exposed n8n automation deployments.
How is this different from the Anthropic Claude Code espionage case?
The Anthropic-disclosed GTG-1002 campaign from November 2025 targeted around 30 organizations using Claude Code. AI handled 80-90% of tasks, with high-confidence attribution to a Chinese state-sponsored group. The Unit 42 case is more than 15 times larger in target count and used DeepSeek rather than Claude. By September 2026, independent testing from Cyber Builders found DeepSeek’s newer V4 Pro model identifying 28 of 32 known vulnerabilities on its own, a capability jump that helps explain how the follow-on campaign scaled so far past GTG-1002’s roughly thirty targets. That trend is not confined to DeepSeek: OpenAI’s broad September 4, 2026 release of GPT-6 Astra, with its cyber-specific capabilities kept opt-in, shows every major lab racing to build, and gate, similar offensive-security skill. It has not, however, been formally attributed to a state actor.
Is DeepSeek banned or restricted because of this?
No restriction tied specifically to this campaign has been publicly announced by any government agency as of this writing. The report has not been followed by a public CISA advisory or confirmed regulatory action referencing the Unit 42 findings.
How many targets were actually compromised?
Public reporting is not fully reconciled on this point. The more conservative and more frequently cited figure is three confirmed compromises out of the 460-plus attempted targets. Some secondary coverage cites a higher figure of 14 successful breaches.
What should companies using Langflow, n8n, or Marimo do right now?
Security teams should confirm patches are applied for the disclosed CVEs. They should also audit which instances of these tools are exposed to the public internet. Any internet-facing low-code or AI-workflow deployment deserves priority access-control review, given how directly these platforms were targeted.
Was the campaign fully autonomous with no human involvement?
Not entirely. Unit 42 describes two tracks. One was largely autonomous, with DeepSeek and Hermes Agent operating under minimal oversight after receiving initial instructions through Telegram. The other was manual, run by a human operator who directed exploitation attempts by hand, including against a Malaysian government target.
