Palo Alto's Unit 42 Uncovers an Attacker Who Wired DeepSeek Into an Autonomous Hacking Agent

A lone attacker wired a freely downloadable Chinese AI model into an off-the-shelf agent framework, pointed it at the open internet through a Telegram chat, and let it hunt. Over the course of the campaign, that setup enumerated targets, dug up public exploit code on its own, and threw attacks at more than 460 internet-facing systems, in some phases without a human touching the keyboard. That is the picture painted this week by Palo Alto Networks' Unit 42, whose researchers say they got an unusually intimate look at the operation after the attacker's own automation blew its cover.

The report, published as the newsletter's Aug. 2, 2026 edition went to press, attributes the activity to a Chinese-speaking threat actor operating under the aliases "knaithe" and "KnYuan," assessed to be based in Zhuhai, China. The centerpiece is not a novel vulnerability or a bespoke piece of malware. It is the plumbing: the actor connected the open-weight DeepSeek model to the open-source Hermes Agent framework and used it as what Unit 42 calls an "autonomous offensive operator."

An agent that hunts on command

According to Unit 42, the attacker orchestrated the agent over Telegram, issuing high-level instructions rather than step-by-step commands. From there the system did the legwork: independently enumerating targets and their weaknesses using the FOFA internet-asset search engine, sourcing exploit tools, and initiating attacks "without human intervention." When early attempts stalled against hardened targets, the agent went looking for alternatives on its own, surveying product families, scanning public code repositories for trending proof-of-concept exploits, and prioritizing which vulnerabilities offered the widest attack surface before pivoting to higher-value targets.

The campaign leaned on seven vulnerability tracks spanning products including Citrix NetScaler, Apache Tomcat, and other widely deployed enterprise software. Crucially, the fully autonomous attacks did not achieve a clean compromise; Unit 42 says the confirmed successes, three cases involving memory data exfiltration from Citrix NetScaler, came through the actor's manual exploitation rather than the agent acting alone. In several instances, target-side configuration requirements were all that stood between a failed run and a breach.

That narrow margin is the point. "While the observed campaign had limited impacts, the workflow confirms a functional, end-to-end autonomous offensive capability," Unit 42 wrote. Or, as the researchers put it in their conclusion, the significance "lies in the trajectory rather than the outcome of any individual campaign."

Unit 42's visibility into the operation was itself a product of the automation. The researchers say the agent inadvertently exposed its own infrastructure by starting a file server in its home directory, laying bare the operator's full tool set, session logs, and configuration files. In a wry twist the report calls out directly, the same autonomous capability built for offense generated the forensic breadcrumbs that would never have existed under careful manual work.

Why the open-weight angle matters

The most consequential finding is not that AI can be used for attacks, but which AI the attacker reached for and why. Unit 42 says the actor tested Western tools, including Claude Code for connectivity checks and signs of OpenAI's Codex in exploit-development directories, but appears to have settled on DeepSeek for the attack phase. The reason, in the researchers' assessment, is blunt: the actor "selected a model with minimal safety controls (DeepSeek) accessed through an open-source framework with no client-side restrictions."

Provider-side guardrails on the Western platforms seem to have gotten in the way. Unit 42 notes that colleagues at OpenAI confirmed their safeguards refused policy-violating requests and that continued attempts led OpenAI's systems to flag and disable an account believed linked to the campaign. The attacker, in other words, followed the path of least resistance to the most permissive option, and an open-weight model running inside an open framework offered exactly that: no server-side referee sitting between the operator and the target.

This is the uncomfortable structural reality of open-weight releases. The same properties that make them valuable, downloadable, modifiable, and free of a vendor's usage policing, also make them attractive to someone who wants an AI that will not say no. The defensive controls that leading labs have invested heavily in simply do not travel with weights that anyone can host themselves.

Just as notable is how the actor assembled a persistent, reusable offensive rig rather than a one-off script: custom automation skills, Model Context Protocol integrations, proxy anonymization, and Telegram-based command and control, all designed to retain and replay successful procedures across sessions. Unit 42's read is that the technical barrier to AI-augmented offensive operations "is low and continues to decrease."

What to watch

The knaithe campaign is best understood as a preview, not a catastrophe; it caused limited damage and the operator's tradecraft was sloppy enough to expose itself. The open questions are about the curve, not this data point. Watch whether autonomous agents start reliably closing the gap between "attempted" and "compromised" as models and frameworks improve, and whether the speed advantage, compressing hours of reconnaissance into minutes, forces defenders to lean harder on their own AI-driven detection. Watch, too, how the open-weight community and policymakers respond to the argument that permissive, self-hosted models are becoming the tool of choice for actors who want to route around vendor safety systems. And keep an eye on the basics: nearly every confirmed impact in this case traced back to exposed, exploitable internet-facing services. Autonomous or not, the attacker still needed an open door.