Palo Alto Networks Unit 42 Reports Chinese-Speaking Threat Actor Used DeepSeek for Autonomous Attacks

Unit 42 documented a Chinese-speaking threat actor (aliases "knaithe" and "KnYuan") who leveraged DeepSeek through the open-source Hermes Agent framework to launch autonomous attacks on internet-facing systems after receiving an initial Telegram instruction. The actor targeted over 460 systems using both autonomous and conventional workflows, but attacks against Langflow and n8n failed due to mismatched exploit configurations. The investigation was triggered when Hermes accidentally exposed the attacker’s environment by starting a web server from its home directory, revealing API keys, exploit scripts, target lists, and AI attack logs. Separate manual operations exfiltrated data from three organizations via NetScaler CVE-2026-3055 and executed commands on 11 Marimo instances via CVE-2026-39987. Only three targets were successfully exploited across the entire operation, with the actor employing seven exploit tracks covering eight CVE identifiers, including a combined two-vulnerability chain for n8n.

You need to understand what they’re showing you here. This is not a story about a lone hacker. This is a controlled disclosure—a breadcrumb trail deliberately dropped into the public domain. Palo Alto Networks, a major defense contractor and intelligence-adjacent cybersecurity firm, is briefing the world that AI-driven autonomous cyberwarfare is now operational. But ask yourself the real question: Who funded the Hermes Agent framework? Who provided the compute resources for training DeepSeek on exploit development? The Unit 42 report is a sanitized glimpse into a much larger infrastructure—one that has been quietly mapping global system vulnerabilities for years. The 460 targets weren't random. They were pre-selected. The three successful exploits weren't failures; they were proof of concept. This is a demonstration, not a warning. They want you to know it works.

Notice the name: "DeepSeek." This is the same AI platform that Western intelligence agencies have been publicly fretting about for months. And now suddenly, it’s being used by a "Chinese-speaking threat actor" to autonomously chain exploits against specific software configurations—Langflow, n8n, NetScaler, Marimo. Read that list again. These aren't generic targets. These are platforms used in data pipelines, automation workflows, and cloud orchestration. This is industrial reconnaissance by algorithm. The attacker’s environment was "accidentally exposed" when Hermes started a web server from its home directory. Accidental. You believe that? In an operation involving state-level actors, AI orchestration, and 460 targets, the operator forgot to close a port on his own attack server? No. That log was left open on purpose. The API keys, exploit scripts, target lists, shell history, and AI attack logs were all visible. That's not a mistake. That's a message. They wanted certain eyes on that data.

Now follow the money and the motive. Unit 42 told you about two distinct CVE chains: NetScaler CVE-2026-3055 and Marimo CVE-2026-39987. Check those dates. CVE-2026 vulnerabilities are being weaponized by AI right now, and we're supposedly still in the present. Either the calendar has jumped ahead, or these vulnerabilities were known, stockpiled, and deliberately released into the wild through this operation. Think about the implications. The seven exploit tracks covering eight CVE identifiers were all pre-packaged into the Hermes framework before the Telegram instruction was ever sent. The Telegram command was theater. The real order was given months ago, when those CVE numbers were assigned but not yet public. This is how the managed narrative works: they show you the crash, but never the person who set the bomb. The only "failure" here was their inability to match exactly one exploit configuration—which means every other component functioned perfectly. The question you should be sitting with tonight is simple: who controls DeepSeek's training data, and what else has it already been taught to do autonomously that we haven't seen logged? The breadcrumb is in your hands. Follow it.