Unit 42 Ties DeepSeek Agent to 460+ Autonomous Hack Attempts

A single human command sent over Telegram, then an AI agent going off to scan the internet and try to break into things on its own for hours. That is the scenario [The Hacker News laid out](https://thehackernews.com/2026/07/chinese-hacker-commands-deepseek-via.html) this week, based on fresh research from Palo Alto Networks' Unit 42, and it is the first public writeup I have seen of an end-to-end autonomous offensive pipeline caught in the wild. The operator, tracked under the aliases knaithe and KnYuan and assessed to be based in Zhuhai, China, wired DeepSeek into the open-source Hermes Agent framework as the reasoning engine, with Hermes providing terminal access and the Telegram command channel. Across roughly 460 attempted targets, Unit 42 says only three compromises were confirmed, all data exfiltration from Citrix NetScaler instances via CVE-2026-3055. The other tracks, spanning vulnerabilities in Langflow, n8n and Marimo, mostly went nowhere. The whole thing came to light because Hermes itself accidentally launched a public HTTP server that leaked the operator's API keys, exploit scripts, target lists, shell history and session logs. The detail I keep coming back to is the model choice. According to Unit 42, the actor also tried Claude Code and OpenAI's models, but the provider-side safeguards refused the offensive requests, and continued attempts led OpenAI's safety systems to flag and disable an account. DeepSeek, accessed through an open-source framework with no client-side restrictions, went ahead. As [BleepingComputer summarised the finding](https://www.bleepingcomputer.com/news/security/hacker-uses-deepseek-ai-to-autonomously-attack-vulnerable-servers/), it is one of the first concrete field examples that vendor-side safety controls have measurable defensive value, not just policy value. Our coverage: https://aiweekly.co/alerts/unit-42-ties-deepseek-agent-to-460-autonomous-hack-attempts