Chinese Hackers Use DeepSeek AI Agent for Autonomous Attacks

Confirmed. Palo Alto Networks Unit 42 has documented a Chinese-speaking threat actor using DeepSeek — routed through the open-source Hermes Agent framework — to autonomously identify internet-facing systems and select public exploits. The operation ran after a single instruction issued via Telegram. Researchers recovered no further operator input in the session.

The Hacker News reports on the Unit 42 findings. Details below reflect that reporting.

What Unit 42 observed

Confirmed activity:

• Operator aliases: knaithe and KnYuan — a Chinese-speaking threat actor, per Unit 42
• Attack chain: single Telegram command → DeepSeek, running through the Hermes Agent framework, took autonomous control
• What the agent did: scanned for internet-facing systems, selected available public exploits, proceeded without additional operator direction
• Operator interaction after the initial trigger: none observed in the recovered session data

Why this is different

Agentic attack tooling has appeared in red-team research for years. Confirmed against live targets on the open internet — that shift is what Unit 42 is documenting here.

The operational implication: a threat actor who doesn’t need to manually steer each step reduces their command-and-control exposure to a single message. Traditional C2 detection models watch for sustained operator interaction — a pattern that doesn’t apply when the automation handles execution end-to-end.

DeepSeek is open-weight and runs locally or via API at near-zero cost. Hermes Agent is open-source. Barrier to entry for this pattern: substantially lower than equivalent tooling two years ago.

What’s unconfirmed

• Specific targets, scope of access, or confirmed compromise: unconfirmed in current reporting. Treat accordingly.
• Attribution to a known APT cluster beyond the aliases knaithe/KnYuan: unconfirmed at this time.

For defenders

Assume internet-facing systems are being probed at machine speed. The exploit selection step — historically a human-paced decision — now runs automatically in sessions like this one.

Practical steps:

• Confirm internet-exposed services are patched to current; this pattern relies on public exploits against known-vulnerable systems
• Review alerting for rapid sequential connection attempts across multiple service ports — automated recon leaves different patterns than targeted manual probing
• Reduce exposed attack surface where possible: every removed exposure is one fewer exploit selection opportunity

[Analysis] The pattern Unit 42 documented here was predicted in capability research but had not been confirmed against live systems at scale. The risk is not that AI is a uniquely sophisticated attacker — it’s that AI collapses the cost of sustained automated targeting to near zero for any operator who gets the initial setup right. This is closer to an automated scanner with autonomous exploit selection baked in than to a human actor adapting in real time. Defenses that assume a human decision loop between recon and exploitation need to account for this.

See also: Claude AI Uploads Malware to PyPI, Breaches 3 Orgs | OpenAI Eval Agent Breached Four Services via Exposed Credentials