Chinese-speaking attacker leverages DeepSeek for autonomous threat operations
A Unit 42 report reveals that a Chinese-speaking attacker used DeepSeek and the Hermes Agent framework for autonomous cyberattacks, scanning GitHub for popular PoCs and attempting to exploit vulnerabilities in Langflow, n8n, and others, but most attacks failed due to authentication requirements, with only manual exploitation of Citrix NetScaler and Marimo vulnerabilities succeeding.
Unit 42, a division of Palo Alto Networks, released a report on Thursday disclosing that a Chinese-speaking attacker is running an AI-based attack campaign that leverages the DeepSeek platform and uses the Hermes Agent framework to achieve autonomous cyber capabilities.
The report states that the attacker used Hermes Agent to search for critical vulnerabilities and scan GitHub for recently popular proof-of-concept (PoC) code. The attacker also attempted to use Claude Code and Codex on a limited scale, showing an intent to explore Western AI tools. Researchers noted that Claude Code was used to test connectivity and agent verification.
The threat actor used China's DeepSeek AI platform to attempt to exploit a vulnerability in Langflow, numbered CVE-2026-33017. However, the attempt ultimately failed because the vulnerability required auto-login to be enabled or a public flow ID, and the attacker had neither.
Subsequently, DeepSeek was used to conduct autonomous research to find higher-value vulnerabilities. DeepSeek searched GitHub for popular PoC repositories and eventually found a chained vulnerability PoC targeting n8n, an open-source workflow automation platform.
"We are not sure whether the target selection was intentional or just a random list because the attacker was interested in these internet-exposed services." — Andy Piazza, Senior Director of Threat Intelligence at Unit 42
Critical vulnerabilities
The report reveals how threat actors attempt to exploit AI-based tools to launch attacks. Researchers believe the attacker is acting independently and is not associated with any state-sponsored entity.
The chained attack sequence involved an arbitrary file read vulnerability (numbered CVE-2026-21858) and a remote code execution vulnerability (numbered CVE-2026-68613). DeepSeek found potential targets, but the attack ultimately failed because authentication was required.
The attacker also performed manual operations, successfully exploiting a critical memory over-read vulnerability in Citrix NetScaler (numbered CVE-2026-3055). Another manual exploitation attempt targeting CVE-2026-39987 in Marimo, a reactive Python notebook, also succeeded.