DeepSeek drives an end-to-end autonomous attack chain through Hermes Agent

Unit 42 recovered a full May session in which a Zhuhai operator sent one Telegram command and the agent did the rest — across 460-plus targets.

Palo Alto Networks’ Unit 42 today published what it calls the first documented end-to-end autonomous offensive AI workflow: a Zhuhai-based operator wired DeepSeek into the open-source Hermes Agent framework and, with a single Telegram command, sent it after more than 460 targets.

The operator, tracked as knaithe and KnYuan, exposed the whole apparatus themselves. Hermes, running in its auto-approving “Yolo” mode, executed python3 -m http.server 8888 out of /home/worker instead of a staging directory. Unit 42 walked away with API keys, exploit scripts, target lists, session logs, and configuration files.

Hermes, from Nous Research, supplied terminal access, a skills system, Telegram command-and-control, and MCP integrations including a FofaMap server for querying FOFA’s asset index. The operator added three custom skills: a jailbreaking module, a WebSocket exploit, and a FOFA search procedure. That’s the entire lift. The model did the rest.

A recovered May 7, 2026 session shows the shape of it. DeepSeek downloaded a Langflow CVE-2026-33017 exploit, enumerated 84 exposed instances via FOFA, found exactly one vulnerable target, then dropped the path because it lacked auto_login. The agent pivoted to n8n, chaining CVE-2026-21858 and CVE-2025-68613 against roughly 40 of about 100 sampled hosts. All required authenticated forms. None fell. It then surveyed ten product families looking for a next move.

The final ledger: three confirmed compromises, all memory exfiltration from Citrix NetScaler appliances via CVE-2026-3055, plus command execution on 11 Marimo instances via CVE-2026-39987.

The comparative detail is the story. The same operator also configured Claude Code and OpenAI Codex, routed through a code.newcli[.]com proxy with attribution headers stripped and response storage disabled. OpenAI’s server-side safety systems flagged the account and killed it. DeepSeek’s guardrails are model-side and left no equivalent trail. The 2008 debates about where liability sits in a distributed system, at the endpoint or in the middle, have found their AI-era analogue. Server-side telemetry is the enforcement surface. Everything else is a log the defender never sees.