Unit 42 researchers have documented what they describe as a functional, end to end autonomous hacking campaign: a Chinese speaking attacker who handed an AI agent the entire job of picking targets, sourcing exploits and firing them off, then checked in over Telegram. The campaign achieved almost nothing on its own. That is arguably the more useful finding, and it does not make the workflow any less real.
The actor, operating under the handles knaithe and KnYuan, ran the open source Hermes Agent framework with DeepSeek as its reasoning engine. Hermes supplied terminal access, Telegram based command and control, and a skills system the operator had customized with three red team modules: a jailbreaking skill called godmode, an unauthenticated WebSocket exploitation skill, and a custom procedure that taught the model to drive FOFA, the internet asset search engine, through a Python script.
What the AI did on its own
Given a task, the agent worked the problem the way a junior operator would. It picked a Langflow flaw (CVE-2026-33017, CVSS 9.8), downloaded a public proof of concept from GitHub, enumerated 84 exposed Langflow instances through FOFA, scanned them and found exactly one running a vulnerable version. Exploitation failed because the bug needs either auto login enabled or a public flow ID, and the target had neither. The same flaw featured in CISA's July catalog of flaws already under active attack.
Rather than stopping, the agent wrote off the whole product as low value and went shopping. It surveyed deployment counts across ten product families, searched GitHub for trending 2026 CVE proof of concept repositories sorted by stars, and settled on n8n, a workflow automation tool with 647,017 instances visible worldwide. It chained two bugs, CVE-2026-21858 for arbitrary file read and CVE-2025-68613 for sandbox bypass to code execution, and correctly worked out from the advisories which version ranges were vulnerable to both. It found three exposed instances running those versions, discovered the exploit needed an unauthenticated upload form, checked more than 50 further Chinese targets, and came up empty. The recovered logs end there.
The damage came from the human
Separately, the same actor ran conventional manual operations with real impact: data exfiltrated from three organizations through a Citrix NetScaler flaw (CVE-2026-3055), confirmed command execution on 11 Marimo notebook instances (CVE-2026-39987), Java deserialization reverse shell attempts against nine Apache Tomcat servers (CVE-2026-34486), and reverse shell callbacks against three IKE VPN endpoints (CVE-2026-33824). Across both modes Unit 42 counted attempts against more than 460 targets. A cloned proof of concept for a PAN-OS User-ID flaw (CVE-2026-0300) was non functional and never run.
How it all leaked
Unit 42 got this view because the agent, told over Telegram to serve some files, ran python3 -m http.server 8888 from the operator's home directory instead of an isolated staging folder. That exposed the whole workspace: AI tool configurations, API keys, exploit scripts, target lists, bash history and the session logs of the autonomous runs. The operator had otherwise practiced decent tradecraft, emptying exploit directories after use and disabling conversation logging. It is the same class of self inflicted exposure that recently revealed an AI assisted malware delivery lab left open on a WebDAV server.
The configuration files are their own tell. The actor primarily used Chinese market models (DeepSeek, Qwen, GLM, Kimi, MiniMax) through direct API endpoints, while routing limited testing of two Western coding tools through a third party proxy at code.newcli[.]com to reduce traceability. That usage was minimal: ten session entries of connectivity checks in one tool, and exploit development directories marked as trusted in the other with no recoverable logs. Unit 42 reads the spread as market evaluation rather than commitment, which fits a broader pattern of attackers testing what these models will actually build for them.
The research was published on 30 July 2026 by Andy Piazza of Palo Alto Networks Unit 42.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.