Researchers at Palo Alto Networks’ Unit 42 have documented what they describe as a functional, end-to-end autonomous offensive AI capability, discovered after a threat actor’s own tooling accidentally exposed their attack infrastructure.
The campaign involved a Chinese-speaking actor operating under the aliases “knaithe” and “KnYuan,” who self-identifies as a “binary security researcher.” The actor used the DeepSeek AI model as the reasoning engine behind Hermes Agent, an open-source framework capable of interacting with operating system terminals, executing commands, and reaching the internet. Hermes includes a “Yolo” mode that lets it run commands, including risky ones, without operator approval.
Unit 42 gained visibility into the operation after Hermes inadvertently stood up a web server from its own home directory, exposing API keys, exploit scripts, target lists, shell history, and AI attack logs.
Autonomous exploitation workflow
The agent was configured to take instructions via a Telegram channel and integrated with the FOFA internet asset search engine for target discovery. In a recovered May 2026 session, the operator reportedly gave only an initial task before Hermes carried out the rest of the operation without further human input.
The agent first targeted internet-exposed Langflow servers vulnerable to CVE-2026-33017, pulling a public proof-of-concept exploit and identifying 84 exposed instances via FOFA. When those targets proved unexploitable, DeepSeek reviewed public exploit repositories and pivoted to the n8n workflow automation platform, where FOFA returned more than 647,000 exposed instances. The agent downloaded an exploit chaining CVE-2026-21858 and CVE-2025-68613 and screened targets for unauthenticated file-upload forms, but the forms it found required authentication, so the automated attempts failed.
Unit 42 noted the significance was not in successful compromise but in speed: the agent performed target identification, evaluation, and scope narrowing in minutes, work that would normally take analysts hours, while also managing its own compute resources.
Manual attacks succeeded elsewhere
Alongside the AI-driven activity, the actor separately ran manual attacks against more than 460 systems using vulnerabilities in Citrix NetScaler, Apache Tomcat, Marimo Notebook, and Windows IKE VPN, among other products. Unit 42 confirmed three successful compromises via the Citrix NetScaler flaw CVE-2026-3055, used to extract memory and hunt for authentication cookies to hijack sessions. The actor also had access to other AI coding platforms, including Qwen, GLM, Kimi, MiniMax, Claude Code, and OpenAI’s Codex, though Unit 42 found these were rarely used.
The disclosure follows a related incident in which exposed Hermes infrastructure revealed details of an alleged attack on Thailand’s Ministry of Finance, discovered by Hunt.io and researcher Bob Diachenko in open web directories containing exploit tools, web shells, and credentials.