Palo Alto Networks’ Unit 42 reports a new example of how modern AI tooling can be folded into real-world intrusion workflows. In this case, a Chinese-speaking threat actor used DeepSeek via Telegram through an open-source agent framework called Hermes Agent, enabling the campaign to search for internet-facing systems and pursue exploitation with limited or no further human input.
According to the researchers, the actor’s session began with a Telegram instruction. After that initial step, the agent performed reconnaissance, selected public exploits, and moved between vulnerability paths—sometimes stopping on unproductive leads and switching based on severity and likely exploitability.
How DeepSeek via Telegram powered an autonomous workflow
Unit 42 says Hermes Agent served as the operational layer around DeepSeek. Once the operator provided the starting command in Telegram, the framework continued the activity unattended. The agent checked versions, downloaded exploit material, and assessed targets it could reach directly over the internet.
Crucially, the researchers noted that they did not find additional operator commands during the recovered session. In other words, after the initial Telegram directive, the agent behaved like a self-guided playbook runner—enumerating, probing, and attempting exploitation while switching tactics when results were poor.
Telegram instruction followed by target hunting
The campaign’s early phase looked like typical opportunistic exploitation, but with a twist: the agent’s decision-making was tied to the AI model used for reasoning and execution. After the first Telegram prompt, Hermes Agent reportedly searched for internet-exposed systems and then selected public exploits to match what it found.
Unit 42 also observed that the actor used aliases associated with names such as knaithe and KnYuan. Across the operation, the researchers attributed exploitation attempts to more than 460 targets, using a mix of autonomous and conventional workflows.
Seven exploit tracks across multiple CVEs
The report describes seven exploit tracks—each mapping to one or more CVE identifiers. In total, these tracks referenced eight CVE entries because at least one chain combined two separate vulnerabilities.
Unit 42 emphasized that not every attempt succeeded. For example, attacks aimed at Langflow and n8n using the DeepSeek-led approach failed because the exposed systems did not match exploit requirements, such as missing configuration elements needed for a working exploit chain.
Why some AI-led targets were still not compromised
A key theme in the findings is that exposure alone was not always enough. Even when the agent found candidate systems, exploitation could fail if preconditions were missing.
For Langflow, Unit 42 reports that a session ended because the target did not satisfy key requirements. Similarly for n8n, although many systems were discovered during the session, the agent did not proceed to compromise because additional targets lacked a usable public form endpoint for the necessary chain.
Example session details: Langflow and n8n
Unit 42 included a recovered session from May 2026 to illustrate the agent’s behavior. In that run, DeepSeek downloaded a public exploit associated with a code-injection issue: CVE-2026-33017 affecting Langflow.
The agent then enumerated 84 instances through FOFA, a search platform for exposed services, and identified at least one target running Langflow version 1.3.4. The attempt stopped after the system lacked an enabled auto_login setting and did not provide a usable public flow identifier.
Next, the agent surveyed 10 product families, searched GitHub for relevant proof-of-concept repositories, and selected n8n as the next target area. Unit 42 says it built an exploit chain combining:
- CVE-2026-21858 (unauthenticated file-access flaw)
- CVE-2025-68613 (expression-injection issue)
In that part of the session, FOFA results returned 25,209 n8n systems in China. DeepSeek then sampled about 100, probed roughly 40, and identified three running vulnerable versions.
However, Unit 42 reports that none were successfully compromised. The agent found endpoints that still required authentication, and many other candidates did not have a usable public form path to carry out the chain.
Data access attempts: NetScaler and Marimo
Beyond the Langflow and n8n attempts, Unit 42 also described separate manual operations that focused on other vulnerabilities.
In those reports, researchers mentioned data exfiltration from three organizations through the NetScaler memory-overread flaw CVE-2026-3055. They also described command execution on 11 Marimo instances through CVE-2026-39987.
At the same time, Unit 42 states it could confirm only three successfully exploited targets across the entire operation. The report does not reconcile those numbers, and they note that The Hacker News reached out to Palo Alto Networks for clarification.
The operational leak: an unintended local HTTP server
One of the most striking details involves how Hermes Agent inadvertently exposed sensitive artifacts. Unit 42 says the framework started a local server using the command:
python3 -m http.server 8888 from /home/worker.
The researchers report that this unintended HTTP server made multiple items accessible, including model configurations, API keys, exploit scripts, target lists, shell history, and autonomous-session logs.
This kind of operational misstep matters: it can turn an otherwise hard-to-detect campaign into an artifact-rich trail that defenders can analyze and use to harden systems.
How the AI reasoning was used
Unit 42 identified DeepSeek as the primary reasoning model inside Hermes Agent. The model provided terminal access, reusable skills, and unattended execution capabilities.
The researchers also reported limited use of other tools such as Claude Code and Qwen Code. They found signs consistent with Codex-related usage in exploit-development directories, but they could not verify actual use because chat logs were not preserved.
Patch priorities and configuration hardening
Based on the findings, Unit 42 recommends organizations focus on patching exposed instances of the affected products mentioned in the report: Langflow, n8n, and Marimo. They also recommend remediation for customer-managed NetScaler ADC or Gateway appliances, particularly when configured as Security Assertion Markup Language (SAML) identity providers.
Unit 42 lists version fixes tied to the vulnerabilities used in the activity:
- Langflow: fixed CVE-2026-33017 in 1.9.0
- n8n: fixed CVE-2026-21858 in 1.121.0
- n8n: fixed CVE-2025-68613 in 1.120.4, 1.121.1, and 1.122.0
- Marimo: fixed CVE-2026-39987 in 0.23.0
Because the attempted n8n chain depended on both flaws, Unit 42 notes that version 1.121.1 is the earliest release that addresses both. For NetScaler, Citrix states CVE-2026-3055 affects appliances configured with SAML identity providers, and administrators can check relevant configuration patterns (for example, add authentication SAML identity provider profiles) and then install the fixed builds provided in Citrix security guidance.
Reduce public exposure of workflow interfaces
Beyond patching, Unit 42 advises removing unnecessary public access to workflow and notebook interfaces. The core reason some attempts failed was related to missing public identifiers and authentication gates, which suggests that tighter access controls can reduce the blast radius even if services remain reachable.
In practice, organizations should audit what’s exposed to the internet, ensure workflow endpoints are not publicly accessible without need, and verify that identity provider configurations are aligned with vendor recommendations.
What this means for defenders
This report illustrates a shift in attacker workflows: rather than relying solely on a human operator for each step, threat actors can combine AI-driven reasoning with automation frameworks that execute tasks through messaging channels like Telegram. That can speed up reconnaissance, exploit selection, and repeated attempts across many targets.
At the same time, the same report shows a counterbalance: exploitation often still depends on specific preconditions, and operational errors—like inadvertently exposed local HTTP content—can create opportunities for detection and response.
Conclusion
Palo Alto Networks Unit 42 describes a campaign where DeepSeek via Telegram was used inside the Hermes Agent framework to attempt largely autonomous exploitation across hundreds of targets. While multiple vulnerability tracks were tried—including chains involving Langflow and n8n—many attempts failed due to missing configuration requirements. The practical takeaway is clear: patch the affected versions, reduce public access to workflow and notebook interfaces, and harden identity provider setups for customer-managed NetScaler deployments.
Source: https://thehackernews.com/2026/07/chinese-hacker-commands-deepseek-via.html
