"While the observed campaign had limited impacts, the workflow confirms a functional, end-to-end autonomous offensive capability," Unit 42 said.
How Unit 42 uncovered an exposed attacker's environment
Palo Alto Networks' Unit 42 discovered the activity after the open-source Hermes Agent accidentally created a web server from its home directory, exposing the attacker's environment. The directory revealed API keys, exploit scripts, target lists, shell history, and AI attack logs that allowed researchers to reconstruct an autonomous campaign. Unit 42 attributed the activity to a China-based threat actor who uses the aliases "knaithe" and "KnYuan" and calls themself a "binary security researcher."
DeepSeek as the reasoning engine for Hermes Agent
Unit 42 found the threat actor running the DeepSeek AI model as the reasoning engine inside Hermes Agent, an open-source framework capable of interacting with system terminals, executing commands, and connecting to the internet. Hermes supports a "Yolo" mode that allows it to execute commands — including risky ones — without asking for operator permission. In this case Hermes was configured to accept instructions from a Telegram channel, use custom offensive-security skills, and integrate with the FOFA internet asset search engine.
Autonomous chain: from Langflow (CVE-2026-33017) to n8n (CVE-2026-21858 + CVE-2025-68613)
Unit 42 recovered a May 2026 session in which the operator appears to have given only an initial task; the agent then conducted the remaining activity autonomously without human feedback. The agent first targeted internet-exposed Langflow servers vulnerable to CVE-2026-33017, downloaded a public proof-of-concept exploit, and used FOFA to identify 84 exposed instances. After scanning those instances and determining they could not be exploited, the agent broadened its search.
DeepSeek led the agent to analyze multiple public exploit repositories and select the n8n workflow automation platform as a higher-value target. Unit 42 reports the agent identified more than 647,000 exposed n8n instances via FOFA, downloaded an exploit that chained CVE-2026-21858 and CVE-2025-68613, and searched for the unauthenticated file-upload forms required to complete the attack. The agent found forms but those forms required authentication, and Unit 42 says the autonomous attempts failed to compromise any of the targeted servers.
Unit 42 emphasized the speed of the autonomous process: what would normally take many hours of manual targeting analysis was executed in minutes, including target identification, sampling, narrowing of scope, and management of compute resources.
Manual attacks, Citrix NetScaler compromises, and other tooling
While the autonomous component did not produce successful remote compromises, Unit 42 documented extensive manual activity by the actor. The threat actor carried out manual attacks against more than 460 systems using vulnerabilities affecting Citrix NetScaler, Apache Tomcat, Marimo Notebook, Windows IKE VPN, and other products. Unit 42 confirmed three successful compromises exploiting Citrix NetScaler vulnerability CVE-2026-3055; the actor used those compromises to extract memory and search for authentication cookies that could be used to hijack sessions.
Unit 42 also found that the attacker had configured other AI coding platforms — including Qwen, GLM, Kimi, MiniMax, Claude Code, and OpenAI's Codex — but that these platforms were not used frequently in the observed campaign.
Hermes' prior exposure and the Thailand Ministry of Finance logs
The exposed campaign follows a separate, recently disclosed incident in which insecure Hermes infrastructure leaked details about an alleged attack against Thailand's Ministry of Finance. According to reporting cited by Unit 42, Hunt.io and researcher Bob Diachenko found open web directories containing exploit tools, web shells, credentials, compiled payloads, and Hermes activity logs. Those logs showed Hermes running in unattended "YOLO" mode to automate post‑exploitation work — searching for privilege escalation, enumerating services, inspecting containers, traversing filesystems, and cataloging documents. Unlike the May 2026 session, that earlier incident did not show Hermes independently choosing targets or the method for initial compromise; a human operator supplied the target, objectives, and attack tools, while Hermes automated routine tasks after access.
What this means for technologists, policymakers, and affected enterprises
- Technologists and security teams: Monitor for orchestration patterns described by Unit 42 — Hermes agents accepting Telegram instructions, integrations with FOFA-style asset search, and agents operating in "Yolo" mode — and prioritize controls on exposed internet-facing services such as n8n, Langflow, and Citrix NetScaler.
- Policymakers and regulators: The episode demonstrates that open-source agent frameworks can be configured to perform rapid, end-to-end offensive workflows; policymakers may want to consider how disclosure, support, or controls around such tooling affect operational risk.
- Affected enterprises and procurement leaders: Unit 42's findings underline that unauthenticated interfaces and exposed instances (Unit 42 found 84 Langflow instances and more than 647,000 n8n instances via FOFA) are primary targets — verifying authentication on file-upload components and inventorying internet-exposed services are immediate, concrete steps aligned with the observed activity.
The record Unit 42 reconstructed is a narrow but telling one: an AI reasoning engine, an open-source agent running in unattended mode, and an operator who provided only a starting prompt combined to map hundreds of thousands of internet‑exposed systems and attempt chained exploits in minutes. The autonomous component did not produce confirmed compromises in the observed session, but the same actor also achieved three successful Citrix NetScaler compromises through manual methods. Together, those facts show an operational model that blends autonomous reconnaissance and exploitation attempts with human-directed follow-up — a capability Unit 42 describes as a "functional, end-to-end autonomous offensive capability."
