A hacker in China sent a single instruction over Telegram, then walked away. What happened next, according to security researchers, was an AI agent that spent the following hours picking its own targets, downloading its own exploit code, and attacking servers across the internet without another word from its operator.
Palo Alto Networks' Unit 42 published the findings on July 30, and they describe something researchers had warned about for months but rarely caught in the wild: an AI model wired directly into an offensive hacking toolkit, running with minimal human oversight, end to end.
What Unit 42 Actually Found
The threat actor operates under the aliases "knaithe" and "KnYuan" and describes themself as a "binary security researcher." Unit 42 assesses the operator is based in China. The researchers only caught the campaign because of a basic mistake: the attacker's own AI agent, called Hermes, accidentally spun up a web server from its home directory, exposing the operator's API keys, exploit scripts, target lists, shell history, and full AI attack logs to the open internet.
That exposure gave Unit 42 an unusually clear window into how the attack was built and run, according to reporting from BleepingComputer.
How the Autonomous Attack Worked
Hermes Agent is an open-source AI framework that can interact directly with operating system terminals, execute commands, and connect to the internet. The operator paired it with DeepSeek as its reasoning engine, then configured it to take instructions from a Telegram channel and pull target data from FOFA, a Chinese internet-asset search engine comparable to Shodan.
"Yolo" Mode
Hermes supports what its documentation calls "Yolo" mode, which lets the agent execute commands, including risky ones, without pausing to ask its operator for permission first. Unit 42 recovered a session from May 2026 in which the operator appears to have issued a single initial task. Everything after that, the researchers say, was the agent working on its own.
The agent first went after internet-exposed Langflow servers vulnerable to CVE-2026-33017. It downloaded a public proof-of-concept exploit, used FOFA to identify 84 exposed instances, and scanned them for exploitable configurations. When none of the accessible targets panned out, it moved on by itself.
It then analyzed multiple public exploit repositories and selected the n8n workflow automation platform, where FOFA showed more than 647,000 exposed instances. The agent downloaded an exploit chaining two separate vulnerabilities, CVE-2026-21858 and CVE-2025-68613, and began checking servers for the unauthenticated file-upload flaw the exploit required. Every instance it found still required authentication, so the autonomous run ended without a single confirmed compromise.
Unit 42's own assessment of the significance is worth quoting directly: "While the observed campaign had limited impacts, the workflow confirms a functional, end-to-end autonomous offensive capability." The researchers added that "this autonomous process of target identification, sampling and narrowing of scope is notable because the system executed hundreds of hours of manual targeting analysis in mere minutes, while also managing its own compute resources."
The Numbers: Autonomous AI vs. Manual Hacking
It's important to separate what the AI agent did on its own from what the human operator did manually — the two phases had very different results.
| Phase | Target System | CVE(s) Used | Exposed Instances Found | Outcome |
|---|---|---|---|---|
| Autonomous (AI-driven) | Langflow | CVE-2026-33017 | 84 (via FOFA) | No compromise — targets not exploitable |
| Autonomous (AI-driven) | n8n workflow automation | CVE-2026-21858 + CVE-2025-68613 | 647,000+ (via FOFA) | No compromise — authentication required |
| Manual (human-directed) | Citrix NetScaler, Apache Tomcat, Marimo Notebook, Windows IKE VPN, others | CVE-2026-3055 and others | 460+ systems targeted | 3 confirmed compromises (via NetScaler flaw) |
So the headline-grabbing part — an AI agent autonomously hunting targets — didn't actually breach anything. The three confirmed compromises came from old-fashioned manual attacks against Citrix NetScaler systems, where the actor exploited CVE-2026-3055 to pull memory contents and search for authentication cookies that could be used to hijack active sessions.
Unit 42 also found the operator had other AI coding tools configured and available, including Qwen, GLM, Kimi, MiniMax, Claude Code, and OpenAI's Codex, but says these were rarely used compared to the DeepSeek-Hermes combination.
This Isn't Hermes' First Exposure
This is the second time in recent weeks that sloppy operational security around Hermes has handed researchers a look inside an active campaign. Security researcher Bob Diachenko and the firm Hunt.io previously uncovered an open directory tied to an attack on Thailand's Ministry of Finance, exposing exploit tools, web shells, credentials, and Hermes activity logs.
That earlier incident was different in one key way: a human operator picked the target and supplied the objectives, and Hermes only automated the post-exploitation cleanup — enumerating services, escalating privileges, and cataloging documents after access was already obtained. The campaign Unit 42 just disclosed goes a step further, with the agent choosing its own targets from scratch.
Why This Matters
The technical result here is almost reassuring: an AI agent given free rein to hunt for victims still failed to breach anything on its own, and the real damage came from a human doing manual exploitation the old way. But the workflow itself is the story. An attacker proved that current open-source agent frameworks, paired with a capable-but-unrestricted model like DeepSeek, can already compress reconnaissance and exploit selection — work that would take a skilled analyst many hours — into a handful of minutes, unsupervised.
That capability doesn't need to succeed every time to be dangerous. It only needs to get cheaper and more reliable, and every iteration of these tools tends to move in that direction. Security teams that assumed AI-driven attacks were a future problem now have a documented, real-world case to plan around today.
It also reinforces a pattern security researchers have flagged repeatedly this year: models with fewer built-in safety restrictions are the ones showing up in offensive tooling, while providers with tighter guardrails see less of this kind of misuse. That's a trend worth watching as more open-weight models compete on capability alone.
My Take
What stands out to me isn't the AI part — it's that the entire operation got caught because of a basic web server misconfiguration, the same category of mistake that trips up plenty of human-run projects. I spend my days thinking about how quickly you can stand up automated pipelines and agent-driven tooling in front-end workflows, and the lesson translates directly: the more autonomy you hand a system, the more its default configuration matters, because nobody's watching closely enough to catch a bad default before it becomes a liability. Whether it's a build pipeline or an offensive hacking agent, "Yolo mode" is a great way to move fast and a great way to expose everything you didn't mean to.
Frequently Asked Questions
Did the AI agent successfully hack anything on its own?
No. The autonomous phase targeted Langflow and n8n servers but failed to compromise any of them — the exploitable configurations either weren't present or required authentication the agent didn't have. The three confirmed compromises came from separate, manually directed attacks on Citrix NetScaler systems.
What is Hermes Agent?
Hermes is an open-source AI agent framework that can control operating system terminals, run commands, and access the internet. It includes a "Yolo" mode that lets it execute actions, including risky ones, without asking the operator for confirmation first.
Why was DeepSeek used instead of other AI models?
Unit 42 found the operator had several AI tools configured, including Qwen, GLM, Kimi, MiniMax, Claude Code, and OpenAI's Codex, but relied primarily on DeepSeek as the reasoning engine behind Hermes. The report doesn't specify why DeepSeek was favored over the alternatives.
How was the campaign discovered?
Hermes accidentally exposed a web server from the operator's own home directory, leaking API keys, exploit scripts, target lists, shell history, and AI attack logs. Unit 42 researchers found and analyzed that exposed data.
Is this the first time an AI agent has been used offensively?
No. A related but distinct incident used Hermes in unattended mode to automate post-exploitation activity against Thailand's Ministry of Finance, though in that case a human operator selected the target and provided the initial access.
