DeepSeek agent automates attacks across Asian networks

A Chinese-speaking hacker used DeepSeek artificial intelligence to autonomously identify vulnerable systems, obtain publicly available exploit code and launch attacks against hundreds of internet-facing targets, exposing how generative AI is moving closer to independently conducting offensive cyber operations.

The campaign involved more than 460 targets and combined AI-directed activity with conventional manual hacking. The operator, who used the online aliases “knaithe” and “KnYuan”, controlled an open-source framework called Hermes Agent through Telegram. DeepSeek functioned as its principal reasoning engine, selecting targets, assessing vulnerabilities and deciding when to change tactics after unsuccessful attempts.

Researchers linked the operator to Zhuhai in southern China but did not associate the activity with a government agency or established cyber-espionage group. The attacker described himself as a binary security researcher and maintained an automated service that collected remote-code-execution disclosures from 17 sources, used DeepSeek to evaluate their exploitability and distributed alerts through Telegram.

The autonomous system was capable of conducting much of the attack sequence after receiving a single instruction. It searched FOFA, a platform used to identify internet-connected assets, checked software versions, downloaded proof-of-concept exploits from GitHub and tested them against exposed services. No further human input was found in one recovered session after the initial command.

DeepSeek first pursued a critical Langflow code-injection vulnerability carrying a severity score of 9.8. The agent located 84 exposed Langflow installations, ran an automated scanner and identified a system using a potentially vulnerable version. The intrusion failed because the target lacked the configuration settings required for exploitation.

Rather than stopping, the AI abandoned Langflow and searched for alternatives. It compared deployment numbers across 10 software families, reviewed trending vulnerability repositories and ranked possible targets by severity, internet exposure and ease of exploitation. It then selected n8n, a workflow-automation platform used to connect applications and build AI-driven processes.

The agent examined a vulnerability chain involving an arbitrary-file-read flaw rated 10.0 and a sandbox bypass rated 9.9. A search identified more than 25,000 exposed n8n systems in China. DeepSeek sampled about 100 addresses and probed roughly 40 of them, identifying three installations with vulnerable software versions.

Those attacks also failed because exploitation required an unauthenticated form permitting file uploads. The available forms were protected by authentication. The AI subsequently scanned more than 50 additional targets in parallel but found none meeting the required conditions.

The autonomous activity did not produce a confirmed full compromise. However, the operator’s parallel manual campaigns caused measurable damage. Data was extracted from three organisations through a critical Citrix NetScaler memory vulnerability, while commands were executed on 11 exposed Marimo notebook instances. Attempts were also made against Apache Tomcat servers and Windows internet key exchange endpoints.

One government organisation in Malaysia was repeatedly targeted over several days. The attacker adjusted memory-reading parameters, maximised extraction attempts and returned through proxy services. Stolen NetScaler memory was searched for authentication cookies, indicating an effort to hijack active user sessions.

The broader victim set covered three countries and several sectors. Much of the automated scanning focused indiscriminately on infrastructure inside China, while the Malaysian operation showed greater persistence and preparation. The findings indicate an opportunistic attacker experimenting with autonomous systems rather than a clearly directed strategic campaign.

Hermes Agent supplied DeepSeek with terminal access, reusable hacking procedures and unattended execution. The operator installed custom capabilities for cyberspace searches and web-terminal exploitation and configured a jailbreaking function designed to weaken model restrictions. Other Chinese models, including Qwen, GLM, Kimi and MiniMax, were configured for testing.

Claude Code was used only in a limited capacity for connectivity checks and proxy validation. Evidence suggested that Codex may have been connected to exploit-development directories, although preserved conversations were unavailable. DeepSeek was accessed directly and became the preferred attack model because its deployment offered fewer practical restrictions within the operator’s chosen framework.

The operation was discovered after the AI itself made an error. Responding to a Telegram command, Hermes Agent launched an HTTP file server from the attacker’s home directory instead of an isolated folder. That exposed API keys, configuration files, exploit scripts, target lists, command histories and logs detailing autonomous attack sessions.