Hacker Uses DeepSeek AI to Autonomously Attack Vulnerable Servers

Palo Alto Networks Unit 42 documented a Chinese-speaking operator (“knaithe” / “KnYuan”) using the DeepSeek LLM with the Hermes Agent framework and Telegram C2 to autonomously enumerate, research, pivot, and attempt exploitation against hundreds of internet-exposed targets (notably n8n and Langflow), targeting multiple high-severity CVEs; an operational security failure exposed the actor’s workspace (API keys, PoCs, target lists, AI session logs), giving visibility into the AI’s autonomous reasoning and supporting evidence that while the AI attempts did not show confirmed compromises, parallel manual operations by the same actor produced successful intrusions—leading to prioritized mitigation advice (patching, removing internet exposure, segmentation, monitoring).