Palo Alto Networks Unit 42 published research this morning reconstructing something the industry has been arguing about in the abstract for two years: an actual, logged, end to end cyberattack run by an AI agent with no human in the loop. A Chinese speaking operator working under the aliases knaithe and KnYuan wired DeepSeek into the open source Hermes Agent framework, sent it a task over Telegram, and stopped typing. The agent enumerated targets, pulled exploit code off GitHub, ranked what was worth hitting and started probing. Both of its autonomous exploitation attempts failed. Every confirmed compromise in the campaign came from the operator doing it by hand afterward.

That gap is the story. The agent was fast at the parts that were already cheap, and useless at the part that actually required skill.

RelatedOpenAI's Models Escaped a Sandbox and Hacked Hugging Face

  • Unit 42 recovered a complete Hermes Agent session log dated May 7, 2026, which is why this reconstruction is granular rather than inferred from telemetry.
  • The operator attempted exploitation against more than 460 targets across seven active CVEs, and the overwhelming majority of that was manual.
  • The two attempts the agent ran unsupervised, against Langflow (CVE-2026-33017) and an n8n chain (CVE-2026-21858 with CVE-2025-68613), both died on authentication requirements.
  • The agent's most consequential real world action was exposing its own operator, by starting an HTTP file server on port 8888 from the home directory and publishing API keys, exploit scripts, target lists and session logs to the open internet.

What did the agent actually do on its own?

Hermes Agent gave DeepSeek terminal access, a Telegram command channel and a skills system. The operator loaded three custom red team skills into it: godmode for jailbreaking model refusals, web-terminal-exploitation for custom WebSocket work, and fofa-cyberspace-search for asset enumeration through the FOFA search engine. DeepSeek itself was called directly against api.deepseek[.]com. Claude Code and Codex sat in the same toolchain but were routed through a proxy at code.newcli[.]com, with the Claude Code attribution header explicitly set to "0" and Codex response storage disabled.

Given one tasking message, the agent ran a recognisable operator workflow. It queried FOFA for exposed instances of a target product, downloaded public proof of concept code from GitHub, weighed candidate vulnerabilities against each other, and scanned more than fifty hosts in parallel. Its own reasoning is in the log, and it reads like a junior red teamer picking the path of least resistance: "The n8n one with 258 stars and CVSS 10.0 looks extremely promising! n8n is a very popular workflow automation tool similar to Langflow, and it has way more stars on the PoC which suggests it's widely exploited."

It also managed its own budget. Facing 25,209 exposed n8n instances in China, it did not try to scan all of them. It sampled roughly a hundred addresses, probed about forty of those for version information, and narrowed from there. Nobody told it to conserve compute. That behaviour, not the exploitation, is the genuinely new capability on display.

Division of labour in the May 7 Hermes Agent session A two column diagram. The left column, labelled human, shows a single Telegram tasking message and, separately, the manual exploitation that breached three organisations. The right column, labelled agent, shows four autonomous steps: enumerate with FOFA, fetch public proof of concept code from GitHub, rank targets by CVSS and repository stars, and probe forty hosts while attempting two exploits. The autonomous exploit success count is zero. MAY 7 SESSION · WHO DID WHAT HUMAN AGENT · DEEPSEEK One Telegram message initial tasking, then silence Manual exploitation 3 organisations breached 1  Enumerate with FOFA: 25,209 hosts in China 2  Fetch public exploit code from GitHub 3  Rank by CVSS and proof of concept stars 4  Probe 40 hosts, attempt 2 exploits AUTONOMOUS EXPLOITS THAT LANDED: 0 genztech.blog
Fig 1 The operator supplied one instruction and, later, the only exploitation that worked. Everything in the right column ran without supervision.

Why did both autonomous attempts fail?

Ordinary configuration, mostly. The Langflow campaign collapsed because the exploit path needed a public flow ID and the deployments the agent found had auto_login switched off. The agent said as much in its own log, then wrote off the target class entirely: "All three Langflow need public flow ID but no auto_login, stuck. Deployments small (84 alive), exploitable probably 0." The n8n run went further and still hit a wall, because the instances it reached exposed forms that required authentication.

The n8n funnel is worth staring at, because it is the clearest picture anyone has published of what an autonomous attack chain converts at.

Conversion funnel of the agent's autonomous n8n hunt A horizontal funnel chart. FOFA identified 25,209 exposed n8n instances in China. The agent sampled about 100, probed about 40 for version information, found 3 running vulnerable versions, and successfully exploited none of them. THE n8n HUNT, START TO FINISH Exposed in China 25,209 Sampled by the agent ~100 Probed for version ~40 Vulnerable build found 3 Actually exploited 0 bar widths compressed for legibility, not linear genztech.blog
Fig 2 · data Twenty five thousand exposed hosts narrowed to three vulnerable builds and zero compromises. Figures from the recovered session log.

Unit 42 is careful to note the margin here was thin rather than comfortable. Exploitation "would have been susceptible" against weaker default configurations. The agent did not fail because it was incompetent at exploitation. It failed because the specific hosts it happened to sample were not misconfigured.

So where did the real damage come from?

The human. Three organisations across three countries were confirmed breached, all through manual work: memory contents exfiltrated via CVE-2026-3055, the out of bounds read in Citrix NetScaler ADC. On top of that, command execution was confirmed on eleven Marimo notebook instances through CVE-2026-39987, Java deserialization reverse shells were fired at nine Apache Tomcat servers via CVE-2026-34486, and reverse shell callbacks were aimed at three IKE VPN endpoints using CVE-2026-33824. A separate PAN-OS User-ID Portal issue, CVE-2026-0300, only ever existed in the toolkit as a non functional proof of concept.

The manual campaign was also the more disciplined one. The autonomous runs hit Chinese domestic infrastructure indiscriminately, while a Malaysian target received sustained attention over multiple days with refined exploitation parameters and proxy anonymisation. Intent lived with the person, not the model.

Autonomous (DeepSeek)Manual (operator)
Exploit attempts logged2Batch, list later deleted
Confirmed compromises03 organisations
Products targetedLangflow, n8nNetScaler, Marimo, Tomcat, IKE
Target selectionIndiscriminate, domesticDeliberate, cross border
Failure causeAuth required, auto_login offn/a
Operational securityLeaked the toolkitProxy anonymisation

The agent's real victim was its own operator

This is the part that deserves more attention than the exploitation scoreboard. Responding to a Telegram command, Hermes Agent started a file server with python3 -m http.server 8888 and ran it from /home/worker rather than an isolated staging directory. That single default choice published the operator's AI tool configurations, API keys, exploit scripts, target lists and session logs straight onto the internet. Unit 42's assessment is blunt: the exposure "would not have existed under manual execution."

A person doing this manually would have picked a directory. The agent picked the working directory, because that is what the command does when nobody specifies otherwise, and it had nobody to specify otherwise. Autonomy did not just fail to add offensive capability here. It introduced a class of self inflicted wound that manual tradecraft does not have.

RelatedGitea Docker flaw CVE-2026-20896 hands over admin access

Who is behind it, and what else are they running?

Unit 42 places the operator in Zhuhai, China. Beyond this campaign, knaithe maintains 1DayNews, an automated vulnerability intelligence pipeline that aggregates remote code execution disclosures from seventeen sources, uses DeepSeek to filter them by exploitability, and pushes alerts out over Telegram. Same model, same messaging channel, applied to the reconnaissance half of the problem instead of the exploitation half. That is the part that is already working.

The toolchain also shows someone shopping. Qwen, GLM, Kimi and MiniMax all appear with minimal usage patterns consistent with evaluation rather than production. Claude Code accounted for ten log entries across three sessions, all connectivity tests. Codex showed traces in exploit development directories. Four separate AI coding tools had client side execution permissions stripped out. Nobody has settled on a stack yet.

  1. May 7, 2026Full Hermes Agent session captured Autonomous cycle from enumeration to failed exploitation
  2. May 2026 onwardManual exploitation across three countries NetScaler, Marimo, Tomcat and IKE endpoints
  3. Jul 31, 2026Unit 42 publishes the reconstruction Seven active CVEs, 460 plus targets documented
  4. NextWhether 1DayNews shortens disclosure to mass scanning Reconnaissance automation is the capability that already works

What should defenders change this week?

Patch the seven CVEs, obviously, with the NetScaler and Marimo issues first since those are the ones with confirmed impact. The less obvious lesson is that authentication defaults did more work in this campaign than any detection product. Langflow's auto_login being off and n8n's forms requiring credentials are the two things that turned an automated hunt into nothing. Audit which internal tooling you have exposed with the convenience toggles flipped on, because those are the hosts an agent finds in a FOFA query and stops at.

Second, watch for scanning at agent tempo. Fifty plus hosts probed in parallel, sampling behaviour that narrows scope mid run, and a pivot to a different CVE within the same session are all patterns a human operator produces slowly and an agent produces in minutes. The volume is not new. The rate of decision changes is.

What to watch · next 12 months
  • Recon automates first, exploitation last. The agent's targeting and triage were credible. Its exploitation was not. Expect that split to persist for a while, and budget defensively for the half that works.
  • Scaffolding is the attack surface. Hermes Agent, not DeepSeek, made every decision that mattered here, including the one that leaked the operator. Frameworks deserve the scrutiny the models are getting.
  • Default configs are load bearing. Two campaigns died on auth requirements nobody thought of as a security control. That is a cheap, repeatable defence worth auditing now.

Our take

Read the coverage that lands over the next few days and a lot of it will treat this as the moment AI attacks arrived. That is not what the log shows. What the log shows is a competent intern with an enormous appetite for parallelism, no judgement about when to stop, and a habit of leaving the front door open. The operator got results the old way and used the agent as a scanner.

The reason it still matters is cost. A human doing that enumeration, PoC retrieval and triage across 25,000 hosts spends days. This ran in one session, off one instruction, on a model anyone can call for pennies. When the exploitation half eventually catches up, the reconnaissance half will already be industrialised and waiting. That is the timeline worth planning against, not this campaign's three victims.

Primary sources

Original analysis by GenZTech, built on the Unit 42 report. Surfaced first by The Hacker News.