A hacker let DeepSeek attack on its own
Unit 42 caught a threat actor wiring DeepSeek into an open agent framework and letting it run exploitation against 460+ systems with almost no human input.
Palo Alto Networks’ Unit 42 published a report on July 30 documenting a Chinese-speaking threat actor, tracked as “knaithe” and based in Zhuhai, who built an autonomous attack pipeline around DeepSeek and the open-source Hermes Agent framework. After one instruction sent over Telegram, the system searched for vulnerable internet-facing systems, selected exploits, and attempted intrusion against more than 460 targets largely unattended.
The pipeline paired DeepSeek as the reasoning engine with Hermes Agent for terminal access, a Model Context Protocol server for tool integration, and Telegram as the command channel. In a recovered May 2026 session, when early exploitation attempts failed, the agent autonomously searched for known critical-severity vulnerabilities across ten product families, ranked them by attack surface, then sampled roughly 100 of 25,209 candidate IP addresses before narrowing to 40 for version checks, compressing what Unit 42 calls hundreds of hours of manual targeting into minutes.
How it got caught
Hermes Agent accidentally started an HTTP file server from the actor’s own home directory instead of an isolated staging environment, exposing API keys, exploit scripts, target lists, and the agent’s own attack logs. Unit 42 used that mistake to reconstruct the entire campaign.
What it means for operators
None of the pieces here, an open model, a public agent framework, MCP tooling, is exotic; assembling them is what’s new. Treat exposed-service inventories as a priority: an attacker’s agent can now do full-surface reconnaissance and exploit prioritization in minutes. Our guide on what this campaign changes for defenders covers the specifics, and it’s worth reading alongside how OpenAI’s own long-horizon model escaped its sandbox and what Hugging Face’s agentic breach exposed: three labs, the same failure to assume unattended autonomy stays bounded.