The campaign demonstrates how threat actors can use agentic AI systems to execute much of the attack lifecycle with limited human interaction.<\/p>\n
Researchers gained visibility into the operation after the Hermes Agent unintentionally launched a Python HTTP file server from the attacker\u2019s home directory. <\/p>\n
Chinese Hacker Uses DeepSeek and Hermes Agent <\/p>\n
The exposure reportedly revealed tool configurations, API keys, target lists, exploit scripts, shell history, and autonomous attack-session logs.<\/p>\n
DeepSeek acted as the primary reasoning engine, while Hermes Agent orchestrated execution. The actor configured custom skills for LLM jailbreaking, unauthenticated WebSocket exploitation, and FOFA-based asset discovery. <\/p>\n
They also integrated an MCP server capable of translating natural-language prompts into FOFA queries, generating Nuclei scans, and conducting internet-wide asset searches.<\/p>\n
![\"Attack](\"https:\/\/www.europesays.com\/france\/wp-content\/uploads\/2026\/08\/chinese-hacker-uses-deepseek-ai-to-automate-vulnerability-exploitation2-6a893f33e8c7d.webp\")
Attack flow (Source: Palo Alto Network)<\/p>\n
In one recovered session from May 2026, the agent independently downloaded a public proof-of-concept exploit for Langflow vulnerability CVE-2026-33017<\/a>, rated CVSS 9.8. It identified 84 exposed Langflow instances through FOFA, scanned them, and found one vulnerable host running Langflow 1.3.4.<\/p>\n However, exploitation failed because the target lacked the required auto_login setting and did not expose a public flow ID. Rather than continuing unsuccessful attempts, the AI agent assessed Langflow as low value and pivoted autonomously toward higher-impact vulnerabilities.<\/p>\n The DeepSeek-powered agent then surveyed 10 product families, searched GitHub for trending 2026 vulnerability PoCs, and ranked candidates by severity, exposure, and likelihood of exploitation. <\/p>\n It selected n8n workflow automation as a priority target after identifying more than 647,000 exposed instances globally, including 25,209 in China.<\/p>\n The attack chain targeted CVE-2026-21858<\/a>, an arbitrary file-read flaw with a CVSS score of 10.0, and CVE-2025-68613<\/a>, a sandbox-bypass vulnerability rated 9.9 that could lead to remote code execution.<\/p>\n The autonomous system downloaded a public exploit, identified three apparently vulnerable n8n versions, and searched for exposed form-upload endpoints required for exploitation. <\/p>\n All identified forms required authentication, preventing compromise. The agent subsequently scanned more than 50 additional Chinese targets but did not find publicly accessible upload forms.<\/p>\n Although the AI-directed campaigns did not result in confirmed compromises, Unit 42 reported successful manual activity by the same actor. <\/p>\n The threat actor allegedly exfiltrated data from three organizations by exploiting Citrix NetScaler vulnerability CVE-2026-3055<\/a> and achieved command execution on 11 Marimo notebook instances via CVE-2026-39987<\/a>.<\/p>\n Other activities included attempts at reverse shells against Apache Tomcat servers and Windows IKE VPN endpoints. The actor reportedly targeted more than 460 systems across autonomous and manual campaigns.<\/p>\n The Citrix NetScaler activity was especially concerning: the operator searched stolen memory data for NSC_AAAC authentication cookies, suggesting an effort to hijack active sessions. <\/p>\n