Recent investigations have uncovered a Chinese-speaking threat actor leveraging the DeepSeek AI model in conjunction with the open-source Hermes Agent framework to execute autonomous cyber attacks. This sophisticated operation was initiated via a single command through Telegram, enabling the agent to identify internet-facing systems and select appropriate public exploits without further human intervention.
The operator, known by aliases such as ‘knaithe’ and ‘KnYuan,’ targeted over 460 systems using both autonomous and traditional methods. The attack strategy encompassed seven distinct exploit tracks, addressing eight Common Vulnerabilities and Exposures (CVE) identifiers. Notably, attempts to exploit vulnerabilities in Langflow and n8n platforms were unsuccessful due to specific configuration requirements not being met on the targeted systems.
In separate manual operations, the threat actor successfully exfiltrated data from three organizations by exploiting the NetScaler memory-overread flaw (CVE-2026-3055) and executed commands on 11 Marimo instances through CVE-2026-39987. However, the overall success rate of the operation was limited, with only three confirmed successful exploits across all targets.
The Hermes Agent framework facilitated this operation by providing terminal access, reusable skills, and the capability for unattended execution. DeepSeek served as the primary reasoning model within this framework, with limited utilization of other AI models such as Claude Code and Qwen Code. The framework’s documentation confirms its ability to operate via Telegram, execute commands, and schedule tasks autonomously.
During a session in May 2026, DeepSeek downloaded a public exploit for the Langflow code-injection flaw (CVE-2026-33017), identified 84 instances through FOFA, and found one target running version 1.3.4. Langflow is an AI agent and workflow builder. The attack was halted because the system lacked the necessary configurations, such as auto_login enabled or a usable public flow identifier.
Subsequently, the agent surveyed 10 product families, searched GitHub for recent proof-of-concept repositories, and selected n8n, a workflow automation platform. It obtained a chain combining the unauthenticated file-access flaw (CVE-2026-21858) with the expression-injection issue (CVE-2025-68613). FOFA returned 25,209 n8n systems in China during the session. DeepSeek sampled about 100, probed roughly 40, and identified three running vulnerable versions. However, all required authentication, and no n8n system was compromised.
Langflow addressed CVE-2026-33017 in version 1.9.0, while n8n fixed CVE-2026-21858 in version 1.121.0. Organizations are advised to patch exposed Langflow, n8n, and Marimo systems, along with customer-managed NetScaler ADC or Gateway appliances configured as Security Assertion Markup Language (SAML) identity providers. Additionally, removing unnecessary public access to workflow and notebook interfaces is recommended.
This incident underscores the evolving landscape of cyber threats, where AI models like DeepSeek are being harnessed to automate and enhance the efficiency of attacks. It highlights the critical need for organizations to stay vigilant, regularly update their systems, and implement robust security measures to mitigate the risks posed by such advanced cyber operations.
