In a May 2026 session that researchers later reconstructed, a single instruction sent over Telegram was enough to set an entire intrusion in motion. Everything that followed — scanning the internet for vulnerable servers, choosing the right exploit, firing it and judging the result — was carried out by an artificial-intelligence agent, with nobody touching the keyboard again. The operation is documented by Palo Alto Networks' Unit 42, which attributes the activity to a Chinese-speaking actor known by the aliases knaithe and KnYuan.
This one is worth reading without the hype. Of the roughly 460 targets the agent went on to attack, only a handful fell. And the campaign came to light because the agent itself made a configuration mistake — it stood up a web server from its own working directory — and left its whole toolkit on show: keys, attack scripts, target lists and even the log of its own decisions. A machine does not yet hack flawlessly on its own, and this one certainly did not. What has changed is more concrete: the cost and time of trawling the internet for a victim have cratered.
- What happened. A Chinese-speaking actor used the DeepSeek model as the decision engine of an open-source agent (Hermes Agent) to automate the discovery and exploitation of exposed servers, orchestrating the whole thing over Telegram.
- Real scope. Around 460 targets attacked and a small number of compromises confirmed by Unit 42, chiefly memory disclosure on Citrix NetScaler devices.
- Why it matters. The novelty is not raw power but speed: reconnaissance and exploitation that used to take hours are compressed into minutes and run in parallel.
- What to do. Shrink the exposed surface, inventory and patch internet-facing AI development tools, prioritise the CVEs in CISA's KEV catalogue, and watch behaviour rather than signatures.
How the campaign was wired together
The setup is simple to describe, and that is exactly what should worry defenders. DeepSeek acts as the brain that decides; Hermes Agent, an open-source agent framework, gives it the means to act: it can open a terminal, run commands and reach the internet. Between the two, Telegram serves as the command post — an improvised command-and-control channel — from which the human operator issues the initial task and then steps back.
From one instruction to hundreds of targets
In the session Unit 42 reconstructed, the agent started from a critical flaw in Langflow, CVE-2026-33017, a tool for building AI agent workflows. It pulled a public exploit from GitHub, used the FOFA search engine to find 84 internet-facing Langflow servers and assessed them one by one. It then asked the model to research higher-value flaws on its own: it found a proof of concept for a chained vulnerability in n8n, another workflow automation platform. All of it without human input.
Seven ways in, all facing the internet
The agent's repertoire was not exotic: known vulnerabilities in internet-facing products, most of them disclosed recently. The table below summarises the seven, described conceptually — what they expose — with nothing that would help reproduce an attack.
| Product | Identifier | What it exposes (conceptually) |
|---|---|---|
| Langflow | CVE-2026-33017 | Unauthenticated remote code execution in a tool for building AI agent workflows. |
| n8n | CVE-2026-21858 and CVE-2025-68613 | A chain of flaws in a workflow automation platform. |
| Citrix NetScaler | CVE-2026-3055 | Device memory disclosure, with possible leakage of sensitive data. |
| Apache Tomcat | CVE-2026-34486 | Bypass of cluster inter-node encryption (the EncryptInterceptor component). |
| Marimo Notebook | CVE-2026-39987 | Command execution on internet-facing data notebooks. |
| Palo Alto PAN-OS | CVE-2026-0300 | A flaw in the firewall operating system. |
| Windows (IKE extensions) | CVE-2026-33824 | A flaw in the Windows IKE VPN component. |
Vulnerabilities cited by Unit 42 in the campaign. Conceptual description; not an exploitation guide.
The irony is hard to miss. Two of the targets — Langflow and n8n — are themselves tools for building AI automations and agents. The same class of software used to assemble the attack is part of the very attack surface such attacks hunt for. It is the pattern we traced in AI model theft: the AI stack is becoming a tool and a target at once.
What the case actually showed
Three facts frame the reading. First: autonomy is not omnipotence. Against 460 attempts, Unit 42 confirms only a small number of successes — mainly memory disclosure on Citrix NetScaler devices — and a session-hijacking attempt against a government entity that the research itself describes as suspected, not confirmed. It tried a lot and hit little.
Second: carelessness gave the operation away. Hermes accidentally launched a web server from its home directory and exposed the full toolkit — API keys, exploitation scripts, target lists, terminal history and the agent's own logs. The automation that gave the attack its scale was also what left it in plain sight.
Third, and the one any security lead should sit with: what has been compressed is time. Unit 42 estimates that DeepSeek, Hermes Agent and associated tooling together turned hundreds of hours of manual target selection into minutes. You do not need a cleverer adversary; a faster and cheaper one will do, able to repeat the cycle in parallel against thousands of addresses.
The window between disclosure and attack is narrowing
Langflow shows the shift. CVE-2026-33017 is critical (CVSS 9.3 per CISA) and allows unauthenticated remote code execution. Exploitation began about 20 hours after the advisory was published, according to Sysdig telemetry reported by several outlets. CISA added it to the KEV catalogue, and JFrog researchers found that the supposedly patched version was still exploitable. Add it all up: once exploitation is automated, the gap between disclosing a flaw and facing mass scanning is measured in hours, not weeks. And AI development tools — Langflow, n8n, notebooks such as Marimo — have slipped into many organisations' exposed surface without passing through the asset inventory or the vulnerability management cycle. Nobody watches them the way they watch a production server, yet they sit on the internet all the same.
Detection: watch behaviour, not signatures
None of these techniques brings a fresh signature to copy into an antivirus. They are caught by what they do, not by what they are. These are the traces worth hunting in your telemetry, framed as threat hunting hypotheses:
- Bursts of exploitation attempts against CVEs disclosed in the last few days, especially from a single address against wide ranges — the fingerprint of automated scanning.
- Requests to AI tooling endpoints (Langflow, n8n, Marimo) from origins that have no business talking to them, or from hosts where nobody remembers installing them.
- Memory-read indicators on Citrix NetScaler devices and anomalous responses on their management interfaces.
- Proof-of-concept downloads from public repositories executed on servers that should never compile or fetch code from GitHub.
- Outbound traffic to the Telegram API or to short-lived command-and-control channels from server workloads rather than user endpoints.
The common thread is behavioural anomaly: a server that suddenly behaves like an attacker's workstation — downloading tools, scanning, talking to messaging services — is a signal, even when each action on its own looks legitimate.
Which defences still hold
The reassuring part is that the fundamentals do not change; they only become more urgent. Four priorities order the response.
First, shrink what is visible from outside. Every internet-facing service is a potential target for an agent that scans without pause, so it pays to know at all times what you expose and why.
Second, treat AI tools as what they are: production software. Inventory the Langflow, n8n and data notebooks scattered across the organisation, patch them, and retire the ones nobody uses. An AI agents and MCP security audit helps surface that layer, the one that rarely appears on the diagrams.
Third, govern the agents themselves as identities. An agent acting on its own is, for control purposes, a non-human identity: it needs scoped credentials, least privilege and an audit trail for every action, exactly as we would demand of a privileged user.
Fourth, speed up patching for what is genuinely being exploited. Prioritise by the KEV catalogue and by evidence of exploitation — not by the CVSS score alone — and set deadlines the organisation actually meets. With exploitation automated, an exposed critical CVE no longer buys weeks of grace.
In regulatory terms, none of this is new: NIS2 and DORA already require organisations to manage the exposure of internet-facing assets and to patch in good time. The attacker's automation simply tightens the clock against which those obligations will be judged.
What changes and what does not
The tempting headline — 'AI now hacks on its own' — both overstates and understates the case. It overstates a capability that still fails often: 460 attempts for a handful of wins, and an operation undone by the agent's own mistake. And it understates the real shift: the adversary is no cleverer than yesterday, it just arrives sooner and for less. For the defender the consequence is practical. The fundamentals are the same as ever — know what you expose, patch what is exploited, detect what behaves oddly — but they now play out against the clock. An exposed server with an unpatched flaw no longer waits weeks for someone to notice; it can have company within hours.
This article describes attack techniques for defensive purposes: detection, containment and governance. It contains no working exploit code or reproducible steps. The detection and patching recommendations should be validated in a controlled environment before being applied in production.
Sources and attribution: the analysis of the campaign is based on the public research of Unit 42 (Palo Alto Networks) with the information available at the date of publication. The target and compromise figures come from that research; attributions to an actor or group may evolve as more information emerges.