A Chinese-speaking operator using the aliases knaithe and KnYuan launched exploitation attempts against more than 460 targets by commanding an autonomous agent named DeepSeek, Palo Alto Networks’ Unit 42 reports.
DeepSeek and the Hermes Agent: autonomous reconnaissance and exploitation
Unit 42 found DeepSeek embedded as the primary reasoning model inside the open-source Hermes Agent framework. After a single Telegram instruction, the agent performed end-to-end reconnaissance and exploitation tasks with no further recovered operator input. Hermes Agent supplied terminal access, reusable skills and unattended execution; its documentation confirms the framework can operate through Telegram, run commands and schedule unattended tasks.
During the recovered May 2026 session, the agent checked product versions, downloaded public exploits, abandoned dead ends and picked alternate tracks based on severity, apparent exploitability and deployment scale. Unit 42 also observed limited references to Claude Code and Qwen Code, and signs of Codex in exploit-development directories, though chat logs were not preserved so actual use of those models could not be verified.
Seven exploit tracks spanning eight CVEs
Unit 42 described seven exploit tracks that together touch eight Common Vulnerabilities and Exposures identifiers because one chain against n8n combined two flaws. Notable CVEs in the report include CVE-2026-33017 (Langflow code injection), CVE-2026-21858 and CVE-2025-68613 (the two flaws chained against n8n), CVE-2026-39987 (Marimo command execution), and CVE-2026-3055 (a Citrix NetScaler memory-overread).
Langflow, an AI agent and workflow builder, was targeted first: DeepSeek downloaded a public exploit for CVE-2026-33017, enumerated 84 public instances via FOFA and found one running version 1.3.4. That attack stopped when the system lacked auto_login and a usable public flow identifier. Langflow fixed CVE-2026-33017 in version 1.9.0. n8n fixed CVE-2026-21858 in version 1.121.0 and CVE-2025-68613 in versions 1.120.4, 1.121.1 and 1.122.0; Unit 42 notes 1.121.1 is the earliest release addressing both n8n flaws together. Marimo fixed CVE-2026-39987 in version 0.23.0.
Scale and outcomes: many probes, few confirmed compromises
Unit 42 says the operator attempted exploitation against more than 460 targets using both autonomous workflows driven by DeepSeek and conventional manual operations. For n8n specifically, FOFA returned 25,209 instances in China during the session; DeepSeek sampled roughly 100, probed about 40, and identified three running vulnerable versions. One of those targets exposed three form endpoints but required authentication; more than 50 additional targets also lacked a usable public form, and no n8n systems were compromised in the chain.
Separately, Unit 42 reported data exfiltration from three organizations via the NetScaler memory‑overread flaw CVE-2026-3055 and command execution on 11 Marimo instances through CVE-2026-39987 during manual operations. Later in the same report Unit 42 also states it could confirm only three successfully exploited targets across the entire operation; the report does not reconcile those two statements. The Hacker News has contacted Palo Alto Networks for clarification and will update the story with any response.
Operational exposure: the agent left a trail
Hermes Agent inadvertently exposed operational artifacts by starting an HTTP server. Unit 42 found the agent executed python3 -m http.server 8888 from /home/worker, which made model configurations, API keys, exploit scripts, target lists, shell history and autonomous-session logs accessible. That unintended HTTP server therefore revealed much of the operator’s tooling and session record to anyone who could reach the host.
Unit 42’s behavioral assessment places the operator in Zhuhai, China. Public material is consistent with, but does not independently verify, that assessment: the GitHub profile displays the name "KnYuan Knaithe," and an older blog under the same handle describes its author as a binary security researcher in Zhuhai. Those profiles do not establish the operator’s legal identity or any state connection.
What this means for technologists, procurement leaders, and affected enterprises
- Technologists and security teams should patch exposed Langflow, n8n and Marimo instances to the fixed versions listed by the vendors, and apply Citrix’s fixes for CVE-2026-3055 on customer-managed NetScaler ADC or Gateway appliances configured as SAML identity providers. Citrix advises administrators to check for add authentication samlIdPProfile .* in appliance configuration and install the fixed builds listed in its security bulletin.
- Procurement and operations leaders running public-facing workflow or notebook interfaces should remove unnecessary public access to those services; Unit 42 highlights that exposed workflow and notebook interfaces were primary targets and that lack of public forms or required authentication stopped several chains.
- Affected enterprises should also inspect exposed hosts for signs the Hermes Agent’s accidental HTTP server leaked keys, scripts or session logs, since Unit 42 recovered model configurations, API keys and exploit artifacts from the served directory.
Unit 42’s account points to an emerging danger: autonomous reasoning models embedded in orchestration frameworks can push an operator’s reach far beyond a single instruction — and can also self-expose operational secrets when their own tooling is misused or misconfigured. The unresolved discrepancy in the report’s exploitation counts is the concrete question left on the table; The Hacker News has sought clarification from Palo Alto Networks and will report any update.
