DeepSeek and Hermes Agent autonomously attacked 460 targets

Unit 42 has documented a campaign in which a Chinese-speaking operator connected DeepSeek to the open-source Hermes Agent framework and Telegram. After an initial instruction, the agent searched for public systems, assessed CVEs, downloaded available exploits, abandoned unproductive paths and selected new targets.

Researchers linked the combined autonomous and manual operation to attempts against more than 460 targets. Confirmed impact was limited. The accurate headline is not “AI compromised 460 servers,” but that a functioning workflow now performs much of an offensive cycle without repeated human instructions.

How researchers observed the operation

The primary Unit 42 report describes an operator mistake. Hermes started a simple file server in its home directory and exposed configurations, API keys, target lists, scripts, shell history and autonomous-session logs.

This visibility revealed not only artifacts but the agent’s decisions. The operator used the aliases knaithe and KnYuan. DeepSeek was the primary reasoning engine, while Hermes supplied a terminal, Telegram integration, task memory and skills. Qwen, GLM, Kimi and MiniMax were also configured. Claude Code and Codex traces were limited; the report does not establish that those tools conducted the successful compromises described.

The autonomous attack cycle

A recovered session from 7 May began with one instruction. Unit 42 found no later operator input. The agent:

1. searched for Langflow instances through FOFA;
2. found a public PoC for CVE-2026-33017;
3. scanned 84 instances;
4. recognised that exploit prerequisites were absent;
5. rejected Langflow as a low-value path;
6. compared ten product families;
7. searched GitHub for popular PoCs;
8. assessed CVSS, deployment scale and apparent exploitability;
9. pivoted to n8n and other vulnerabilities.

This autonomous pivot distinguishes the workflow from a conventional script. A script follows a predefined sequence. An agent interprets results, forms a hypothesis and changes its plan.

Seven tracks and eight CVEs

The report describes seven exploitation tracks spanning eight CVE identifiers because the n8n chain combined two flaws. Products included Langflow, n8n, Marimo and NetScaler.

DeepSeek-led attempts against Langflow and n8n failed because target configurations did not meet the exploit conditions. In manually operated portions of the campaign, researchers observed data exposure through a NetScaler flaw and command execution on Marimo instances. Public counts in the report are not completely reconciled, so the defensible conclusion is limited confirmed impact, not hundreds of compromises.

The model is not the whole system

DeepSeek supplied decisions, but the capacity to act came from the composition:

• Hermes Agent with shell access;
• FOFA asset search;
• an MCP server translating natural language into queries;
• Nuclei and PoC scripts;
• public GitHub;
• API keys;
• Telegram as the operator channel;
• unrestricted network access.

Assessing the model alone is insufficient. Without tools, the same model can describe an attack. With a terminal, asset search, memory and networking, it becomes an operator.

What AI changes for attackers

An agent lowers the labour cost between known tools. It does not need a new zero-day. It can:

• retain context across multiple products;
• compare CVE reach and prerequisites;
• adapt tool arguments;
• interpret PoC failures;
• change targets after failure;
• generate notes and follow-up queries.

The main operational risk is a shorter interval from public PoC to internet-wide testing. Defenders should no longer assume they have several quiet days before someone tries a newly published chain.

Actions for technical teams

Prioritise publicly exposed administration, automation and notebook interfaces. Langflow, n8n, Marimo and similar systems should sit behind a controlled access layer, with authentication and current software.

A practical plan:

1. inventory public panels, APIs and notebooks;
2. compare exact versions with vendor advisories;
3. remove unnecessary internet access;
4. enforce MFA and constrain service accounts;
5. alert on broad endpoint enumeration;
6. detect rapid sequences testing multiple CVEs;
7. monitor PoC downloads and scanner execution on servers;
8. rotate secrets stored in workflow tools;
9. retain reverse-proxy, application, host and cloud logs;
10. measure time from advisory to isolation or patching.

Detect behaviour, not a model brand

Do not search only for “DeepSeek.” The next campaign may use another provider or local weights. Correlate:

• asset-search requests followed by scanning;
• multiple CVE signatures from one source;
• repeated cloning of exploit repositories;
• unusual child processes created by AI applications;
• new HTTP servers in agent workspaces;
• API keys left in configuration files;
• Telegram or unusual proxy traffic from an operator host.

Our guides to AI-agent observability and agent sandboxing provide the defensive design pattern.

Sources versus Breachroad conclusions

Unit 42 confirms the Hermes configuration, one logged autonomous session, independent pivots and limited impact across the wider operation. It does not establish that DeepSeek autonomously compromised 460 systems.

Breachroad’s conclusion is that response speed for known CVEs and reduction of public attack surface matter more than guessing which model an adversary will use. AI improves attack economics; it does not remove the need for a vulnerable target.

Secure AI implementation training helps teams control tools, MCP, secrets and autonomy in their own agents. Organisational cybersecurity training prepares administrators and developers for a shrinking patch window.