# DeepSeek turned into autonomous hacking tool, hit 460+ systems
Palo Alto Networks' Unit 42 has documented what appears to be the first caught-in-the-wild case of an open large language model being wired into an autonomous offensive hacking pipeline.
A threat actor operating under the aliases "knaithe" and "KnYuan," assessed to be based in Zhuhai, China, used the open-source DeepSeek model as the reasoning engine inside Hermes Agent, an open-source agentic framework. The operator issued a single command via Telegram. DeepSeek then autonomously scanned for vulnerabilities, selected exploits by severity, and attempted to breach more than 460 internet-facing systems.
Three compromises were confirmed, all involving data exfiltration from Citrix NetScaler instances via CVE-2026-3055. The remaining targets were probed for flaws in Langflow, n8n, Marimo Notebook, Windows IKE VPN, and Apache Tomcat, among others.
## How it worked
The attacker configured Hermes Agent in "Yolo mode," which requires no human approval between the initial Telegram instruction and exploitation attempts. DeepSeek acted as the decision engine: it identified targets, evaluated which vulnerabilities to try, abandoned failed attack paths, and managed its own compute resources. Unit 42 said the system compressed hundreds of hours of manual targeting analysis into minutes.
The operation came to light only because Hermes Agent accidentally created a web server from its home directory, exposing the attacker's full environment: API keys, exploit scripts, target lists, shell history, and AI attack logs.
## The open-weight safety question
The most consequential detail is that DeepSeek performed offensive work that Claude and OpenAI models refused. When the same malicious requests were sent to closed models, they declined. DeepSeek, being an open model that anyone can download and modify, has no enforceable guardrails. An attacker running it locally can strip safety training through fine-tuning or prompting.
This is the first public, real-world demonstration of the open-weight safety dilemma. Closed models like Claude and GPT-5.6 enforce safety restrictions through the provider's servers. Open models cannot, because the model runs on the attacker's hardware under their control. The same openness that democratizes AI access also removes any ability to prevent misuse.
Unit 42 also found limited use of Claude Code and Qwen Code in the attacker's environment, plus signs of Codex use in exploit-development directories, though chat logs were not preserved well enough to confirm the latter.
## What it means
The campaign had limited impact: three confirmed breaches out of 460 attempts. But the workflow is what matters. Unit 42 described it as "a functional, end-to-end autonomous offensive capability." The barrier to entry for AI-driven attacks has dropped from research lab to open-source framework plus a Telegram account.
The incident complicates the open-weights advocacy from companies like Nvidia and Meta. The same properties that make open models valuable for research, privacy, and self-hosting also make them available for autonomous weaponization. This case does not settle the debate, but it makes the risk concrete rather than hypothetical.
## Sources
- [The Hacker News: Chinese Hacker Commands DeepSeek via Telegram to Autonomously Attack 460+ Systems](https://thehackernews.com/2026/07/chinese-hacker-commands-deepseek-via.html) - [BleepingComputer: Hacker uses DeepSeek AI to autonomously attack vulnerable servers](https://www.bleepingcomputer.com/news/security/hacker-uses-deepseek-ai-to-autonomously-attack-vulnerable-servers/) - [Palo Alto Networks Unit 42: Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks](https://unit42.paloaltonetworks.com/chinese-speaking-threat-actor-ai-models-autonomous-cyberattacks/) - [AI Weekly: Unit 42 Ties DeepSeek Agent to 460+ Autonomous Hack Attempts](https://aiweekly.co/alerts/unit-42-ties-deepseek-agent-to-460-autonomous-hack-attempts)
