Unit 42 Confirms: Hacker Used DeepSeek-Powered AI Agent to Autonomously Attack 460+ Servers
AI agents autonomously launching cyberattacks is no longer a hypothetical conference demo — Palo Alto Networks' Unit 42 just published the full anatomy of a real-world case.
Three Key Takeaways
One Telegram message kicked off the entire kill chain. Unit 42 tracked a threat actor operating under the aliases knaithe and KnYuan who wired DeepSeek as the reasoning model inside the open-source Hermes Agent framework. A single Telegram instruction set the agent in motion: it autonomously discovered targets, assessed vulnerabilities, retrieved public exploit code, and launched exploitation attempts against more than 460 internet-facing systems. Hermes Agent supports a feature called "Yolo mode" that lets the agent execute commands — including high-risk operations — without requesting operator confirmation at each step.
The attacker was betrayed by their own tool. The campaign was uncovered because Hermes Agent accidentally spun up a web server from its working directory, exposing the attacker's entire operational environment to the open internet — API keys, exploit scripts, target lists, shell history, and AI attack logs, all laid bare. Unit 42 reconstructed the full attack chain from this accidentally exposed server.
Zero successful breaches, but the workflow is proven. Unit 42 explicitly states that the autonomous attacks did not successfully compromise any of the targeted servers. However, the researchers emphasize that the workflow demonstrates a complete attack loop — discovery, assessment, exploitation — fully AI-driven, with the human operator needing only to send a single message. Forbes cited security analysts noting that AI-agent-driven attacks like this may not remain isolated incidents but signal an emerging attack paradigm.
WangDou's Take
460 servers, zero successful breaches — in a traditional security report, that would file under "low threat." But flip the lens: one person triggered 460 attack attempts with a single message. That used to take a team a full week. The low success rate is not because the method failed; it is because the targets happened to be patched. Next time they hit an unpatched one? Even more ironic: this attacker was not caught by a detection system. They were caught because their own AI tool fumbled — it auto-started a web server and dumped all the evidence online. AI agent offensive capability is evolving, but its operational security awareness is currently somewhere below that of an intern.
Source: The Hacker News, BleepingComputer, Forbes