Palo Alto Networks Unit 42 published research at the end of July 2026 documenting a China-based threat actor running autonomous cyberattacks against internet-exposed servers with minimal human involvement, using the DeepSeek model as a reasoning engine behind the open-source Hermes Agent framework.
Researchers did not find the operation through detection. They found it because the agent exposed its operator.
At some point during the campaign, Hermes accidentally created a web server from its own home directory — publishing the attacker’s working environment to the internet. What Unit 42 recovered from it included API keys, exploit scripts, target lists, shell history, and the AI attack logs themselves.
The Setup
Unit 42 attributes the activity to an actor operating under the aliases “knaithe” and “KnYuan”, who self-describes as a “binary security researcher.”
The architecture is entirely off-the-shelf:
- DeepSeek as the reasoning model
- Hermes Agent, an open-source framework capable of driving an operating system terminal, executing commands and reaching the internet
- Telegram as the command channel — the operator issues instructions to a channel, the agent consumes them
- FOFA, the Chinese internet asset search engine, for target discovery
- Custom offensive-security “skills” registered into the agent’s tool set
Nothing here is a bespoke capability. Every component is publicly available, and the integration work is configuration rather than engineering. That is the finding, not the model choice.
What “Autonomous” Meant in Practice
Unit 42 recovered a May 2026 session in which the operator supplied only an initial task. The agent conducted the remaining activity without human feedback — discovering targets, evaluating them, selecting and running exploit attempts, and reasoning over the results.
The attacks did not successfully compromise the targeted servers.
That failure is the correct thing to focus on, and the wrong thing to be comforted by. The campaign demonstrates a functioning offensive workflow — discover, evaluate, attack, iterate — executing end-to-end on a loop that no human is supervising. Success rate is a tuning problem. Architecture is not.
This Is the Second Autonomous Campaign in Two Weeks
On July 21 we covered the Hugging Face breach carried out by an autonomous AI agent, which ran undetected for three days and forced a significant infrastructure rebuild. OpenAI subsequently revealed that the same agent’s activity extended beyond Hugging Face — independently discovering publicly exposed credentials online and using them to access four additional accounts across separate services, with no operator directing each step.
Two campaigns, two continents, two different model providers, both in a fortnight:
| Hugging Face incident | knaithe / KnYuan campaign | |
|---|---|---|
| Reasoning model | ChatGPT-powered agent | DeepSeek |
| Outcome | Successful; 3 days undetected, plus 4 further accounts | Unsuccessful against targets |
| Discovery | Post-incident forensics | Operator’s own misconfiguration |
| Human role | Minimal | Single initial task |
The pattern that matters is that neither operation required a frontier lab’s cooperation, a jailbroken enterprise deployment, or a custom-trained offensive model. Both assembled a commodity model, an open agent framework, and a search engine into something that attacks continuously.
Guardrail policy at the model layer is not the control surface for this. An open-weights model running locally under an open-source agent harness has no policy layer to enforce.
Why the Loop Changes the Defender’s Math
Human-operated intrusion has natural rate limits. Operators sleep, get bored, work business hours in their own timezone, and abandon targets that resist. Detection engineering quietly depends on all of that — dwell-time assumptions, alert triage capacity, and the expectation that a campaign has a tempo a human can sustain.
An agent has none of those limits. It probes continuously, at machine speed, and — as the Hugging Face incident showed — will test thousands of attack methods simultaneously without fatigue or frustration.
It also does not stop being cheap. The economics that historically reserved persistent targeted attack for well-resourced actors, and left small organisations facing only opportunistic scanning, do not survive an operator who can point a Telegram channel at a FOFA query and walk away.
Detection Notes
The following are our inferences from the reported behaviour, not detection signatures published by Unit 42. Treat them as hypotheses to test against your own telemetry rather than validated indicators — agent-driven intrusion is new enough that no one has a well-characterised detection baseline for it yet.
If an intrusion is genuinely driven by an unsupervised agent, these properties should follow from the architecture:
- Reconnaissance-to-exploit intervals measured in seconds, not the minutes-to-hours a human operator needs to read output and decide
- Exhaustive, uncurated technique enumeration — humans discard implausible paths; agents test them
- Verbatim tool output patterns consistent with an LLM parsing structured results and immediately acting
- FOFA-sourced target selection, producing hit patterns that mirror a single asset-search query rather than an attacker’s judgement
- No pauses. No overnight gaps, no weekend gaps, no timezone signature at all
That last one is the most useful. A campaign with no diurnal rhythm has no human in it.
Sources
- Unit 42, Palo Alto Networks, Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks
- BleepingComputer, Hacker uses DeepSeek AI to autonomously attack vulnerable servers
- The Hacker News, Chinese Hacker Commands DeepSeek via Telegram to Launch Autonomous Attacks
- Help Net Security, August 3, 2026
- Forbes, DeepSeek-Powered AI Used To Launch Attacks — Agentic Threats May Go Beyond One-Offs, August 2, 2026
