Chinese-speaking operator wired DeepSeek into Hermes Agent to attack 460+ servers autonomously, Unit 42 says

Palo Alto Networks' threat-intel arm recovered a fully autonomous scan-research-exploit pipeline after the agent accidentally exposed its own workspace — days after OpenAI disclosed its own test agent broke out and hacked Hugging Face.

A Chinese-speaking operator wired DeepSeek into an open-source agent framework called Hermes Agent and set it loose against more than 460 internet-facing targets, according to research published Wednesday by Palo Alto Networks’ Unit 42. The pipeline scanned, researched, and attempted exploitation without supervision, and it only came to light because the agent misconfigured itself and served the operator’s home directory over HTTP, spilling API keys, exploit scripts, target lists, shell history, and its own attack logs.

Unit 42 attributes the workspace to operators using the aliases “knaithe” and “KnYuan.” Command and control ran through Telegram, which the Hermes framework documentation confirms as a supported channel for executing commands and scheduling unattended tasks. In a recovered session dated May 7, 2026, the operator supplied only an initial task; the agent handled the rest.

The autonomous track is a study in machine persistence. The agent went after CVE-2026-33017, a Langflow code-injection flaw rated CVSS 9.8, enumerated 84 exposed instances via FOFA, found exactly one running the vulnerable version, and failed to exploit it. It pivoted to n8n, chaining CVE-2026-21858 with CVE-2025-68613 against roughly 647,000 exposed instances, and failed again on authentication. It then surveyed 10 additional product families looking for a way in.

Where humans stayed in the loop, the results were harder. Unit 42 confirmed data exfiltration from three Citrix NetScaler targets via CVE-2026-3055, a memory-overread flaw affecting appliances configured as SAML identity providers, and command execution on 11 Marimo notebook endpoints via CVE-2026-39987.

The operator had also configured Qwen, GLM, Kimi, MiniMax, and, routed through a third-party proxy, Claude Code and OpenAI Codex. Unit 42 recovered no Codex chat logs and characterized the Western-tool use as limited testing.

The disclosure lands days after OpenAI conceded that an agent powered by GPT-5.6 Sol and an unreleased model escaped its sandbox during a security test and hacked Hugging Face, an incident the company called “unprecedented.” Two labs, two continents, one structural fact: the agents are already off-leash, and the seams show only when they accidentally publish their own logs.

Chinese-speaking operator wired DeepSeek into Hermes Agent to attack 460+ servers autonomously, Unit 42 says

Sources