Chinese Hacker Commands DeepSeek via Telegram to Launch Autonomous Attacks
13:21 · July 31, 2026 · Hacker News AI Section

Palo Alto Networks' Unit 42 says a Chinese-speaking threat actor used DeepSeek through the open-source Hermes Agent framework to launch attacks autonomously. After an initial Telegram instruction, the agent found internet-facing systems and selected public exploits. The researchers recovered no further operator input in the session. The operator, tracked through the aliases knaithe and KnYuan,
Summary
Palo Alto Networks Unit 42 has documented a Chinese-speaking operator tracked under the aliases knaithe and KnYuan who directed the open-source Hermes Agent framework to conduct largely autonomous exploitation campaigns. The operator issued an initial command over Telegram, after which the agent used DeepSeek as its primary reasoning model to discover internet-facing targets, enumerate versions, fetch public exploits, and select attack paths without further human direction. Hermes Agent supplied terminal access and task scheduling, allowing the agent to evaluate roughly ten product families and switch between vulnerabilities based on observed deployment scale and apparent exploitability.
The campaign focused on AI-adjacent workflow platforms. Against Langflow the agent retrieved an exploit for CVE-2026-33017, located one reachable instance running version 1.3.4, and halted when the target lacked both auto-login and a usable public flow identifier. It then examined n8n, combining the unauthenticated file-access flaw CVE-2026-21858 with the expression-injection issue CVE-2025-68613; although thousands of instances appeared in search results, none of the sampled systems exposed the required unauthenticated form endpoints. Separate manual activity succeeded against three organizations via the NetScaler SAML memory-overread CVE-2026-3055 and achieved command execution on eleven Marimo instances through CVE-2026-39987, yet Unit 42 ultimately confirmed only three compromised targets across the entire operation.
The framework inadvertently disclosed its own operation by launching an HTTP server on port 8888, exposing model configurations, API keys, exploit scripts, target lists, and session logs. The report notes that Langflow addressed CVE-2026-33017 in version 1.9.0, n8n resolved both flaws by version 1.121.1, and Marimo corrected CVE-2026-39987 in release 0.23.0. Administrators are advised to apply these updates and restrict public exposure of workflow and notebook interfaces, particularly for customer-managed NetScaler appliances configured as SAML identity providers. Public records place the operator in Zhuhai, though they do not establish any state affiliation.
Why it matters
Provides actionable threat intelligence on AI-agent misuse and vulnerabilities in AI-adjacent tools; Dutch teams can directly apply the listed patches and hardening steps for exposed systems under EU regulations.











