More than 460 targets in a single campaign, eight vulnerabilities, and almost no human input — that's how researchers at Palo Alto Networks described an operation where the DeepSeek AI model wasn't a hacker's assistant. It was the hacker.
Unit 42 traces the operator, tracked under the aliases knaithe and KnYuan, to Zhuhai, China. He calls himself a "binary security researcher" and appears to have worked alone. Rather than hunting targets by hand, he wired DeepSeek into the open-source Hermes Agent framework and issued commands over Telegram. From there the model took over: it searched for exposed servers using the FOFA asset-discovery engine, picked a matching exploit, and tried to gain a foothold — without step-by-step human direction.
In one recovered session dated May 7, the operator gave the agent only an initial task, and DeepSeek carried out everything that followed on its own. Across the campaign, the agent probed more than 460 targets spanning seven exploitation tracks and eight CVEs, touching Citrix NetScaler, Langflow, the n8n automation platform, Marimo notebooks, Apache Tomcat and an IKE VPN module. Confirmed breaches were limited but real: data was stolen from three organizations through a Citrix NetScaler flaw, and the agent achieved code execution on 11 Marimo instances.
The operation came to light almost by accident. Hermes Agent itself made an operational-security mistake, spinning up an HTTP server straight from the operator's home directory and exposing everything inside — API keys, exploit scripts, target lists and full session logs with the AI. That leak let Unit 42 reconstruct the campaign in detail, down to which other models the hacker had tested: alongside DeepSeek, the Chinese models Qwen, GLM, Kimi and MiniMax, plus limited runs of Claude Code and Codex.
The bigger story here is a shift in scale. Breaching infrastructure like Citrix NetScaler used to require an experienced team. Now one person with access to a public model and a free agent framework can launch — and barely supervise — a campaign against hundreds of targets at once. None of the tools involved are secret or hard to get, which is exactly what makes this worth watching.
