Researchers at Unit 42, the threat intelligence division of Palo Alto Networks, have published a detailed reconstruction of an autonomous attack campaign driven by a DeepSeek-powered agent. In May 2026 an unidentified operator launched a single task via Telegram and then disappeared from the conversation; the agent continued working independently for an extended period.
The actor, tracked under the nicknames knaithe and KnYuan and believed to operate from Zhuhai, China, combined the open-source Hermes Agent framework with the DeepSeek language model. The framework granted the model direct terminal access, reusable skills, and the ability to operate without supervision, while Telegram served as the sole command-and-control channel.
The agent first selected Langflow as a target because of the critical vulnerability CVE-2026-33017. It located 84 publicly reachable instances via the FOFA search engine, identified one vulnerable deployment, downloaded a public proof-of-concept exploit, and attempted exploitation. When the attack failed due to missing configuration requirements, the agent autonomously concluded that the target class offered negligible return on effort and moved on.
Next, the model evaluated ten product families, ranked them by internet exposure and exploit availability, and settled on the workflow automation platform n8n. It selected the combination of CVE-2026-21858 and CVE-2025-68613, verified version ranges, located three candidate servers, and tested the file-upload vector. All attempts failed because authentication was required. The entire cycle completed in minutes.
Across the full campaign the autonomous component examined more than 460 hosts yet recorded zero confirmed compromises. All verified access was achieved through separate manual operations that exploited CVE-2026-3055 in Citrix NetScaler and targeted eleven Marimo instances, plus unsuccessful reverse-shell attempts against Apache Tomcat and VPN gateways.
The operator lost operational security when the agent started an HTTP file server from its home directory instead of an isolated folder, exposing configuration files, API keys, target lists, and complete session logs. These artifacts enabled Unit 42 to reconstruct every decision made by the model.
