Unit 42 documents a hacker running autonomous attacks with DeepSeek in an agent framework

Researchers have documented a hacker who wired DeepSeek into an agent framework, sent one instruction over Telegram, and let it attack on its own.

Palo Alto Networks’ Unit 42 published the analysis on July 31, 2026. The operator, tracked under the aliases knaithe and KnYuan and based in Zhuhai, embedded DeepSeek inside the open-source Hermes Agent framework, which supplied terminal access, a skills system and Telegram-based command and control.

What the agent did on its own

After an initial Telegram instruction, the agent found internet-facing systems, selected public exploits, checked software versions, abandoned unproductive paths and ranked vulnerabilities by severity, deployment scale and exploitability. Researchers recovered no further operator input in that session.

The scale: more than 460 attempted targets across seven vulnerabilities, using both autonomous and conventional workflows. Unit 42 notes the actor also tested other models, including Qwen, GLM, Kimi and MiniMax.

What actually landed

The confirmed impact is the more useful number. Unit 42 confirmed data exfiltration from three Citrix NetScaler targets (CVE-2026-3055) and command execution on eleven Marimo notebook instances (CVE-2026-39987). The actor separately kept targeting a government entity in Malaysia, using session hijacking across several days behind proxy anonymization.

So roughly fourteen confirmed hits out of more than 460 attempts. That is not a superweapon.

Volume decoupled from effort

It is something arguably more consequential: attack volume decoupled from attacker effort. A low success rate matters less when one person can point an agent at hundreds of targets and walk away. The economics of intrusion change even if the per-attempt quality does not.

Does a low success rate reassure you here, or is the volume the whole point? Security teams are about to find out which reading is right, at scale.