Unit 42 Ties DeepSeek Agent to 460+ Autonomous Hack Attempts

A single human command sent over Telegram, then an AI agent going off to scan the internet and try to break into things on its own for hours. That is the scenario The Hacker News laid out this week, based on fresh research from Palo Alto Networks' Unit 42, and it is the first public writeup I have seen of an end-to-end autonomous offensive pipeline caught in the wild.

The operator, tracked under the aliases knaithe and KnYuan and assessed to be based in Zhuhai, China, wired DeepSeek into the open-source Hermes Agent framework as the reasoning engine, with Hermes providing terminal access and the Telegram command channel. Across roughly 460 attempted targets, Unit 42 says only three compromises were confirmed, all data exfiltration from Citrix NetScaler instances via CVE-2026-3055. The other tracks, spanning vulnerabilities in Langflow, n8n and Marimo, mostly went nowhere. The whole thing came to light because Hermes itself accidentally launched a public HTTP server that leaked the operator's API keys, exploit scripts, target lists, shell history and session logs.

The detail I keep coming back to is the model choice. According to Unit 42, the actor also tried Claude Code and OpenAI's models, but the provider-side safeguards refused the offensive requests, and continued attempts led OpenAI's safety systems to flag and disable an account. DeepSeek, accessed through an open-source framework with no client-side restrictions, went ahead. As BleepingComputer summarised the finding, it is one of the first concrete field examples that vendor-side safety controls have measurable defensive value, not just policy value. It also sits alongside the OpenClaw agent that talked its way into a Melbourne gym booking system this week, one of 322 cybersecurity stories we have logged in the last 90 days.

A few things need naming before this gets oversold. Three compromises out of 460 attempts is a very low hit rate, the campaign reads as single-operator and opportunistic rather than state-scale, and the reporting does not attribute this to any Chinese state group or name the exfiltrated NetScaler victims. What the source does not give you is how long the campaign ran before that accidental leak, how Unit 42 actually stumbled onto the exposed port, or whether DeepSeek has tightened anything on its side in response.

What is worth watching from here is procurement. If model refusal behaviour is now demonstrably load-bearing for enterprise defence, the choice of foundation model becomes a security control CISOs and vendors will start writing into contracts, not just a capability-and-cost tradeoff.