The Machine at the Keyboard

Inside an AI Agent’s Attempt to Hack the Internet

By Jonathan Lockhart

The command arrived through Telegram.

Somewhere in Zhuhai, a city on China’s southern coast, an operator using the names knaithe and KnYuan had assembled what amounted to a small automated hacking department. Its principal worker was not another person. It was DeepSeek, connected to an open-source framework called Hermes Agent and equipped with terminal access, internet-search tools, vulnerability-scanning software and customized instructions for offensive security work.

The operator could assign a goal from a phone. The agent could then search the public internet for exposed servers, identify potentially vulnerable software, retrieve exploit code, test prospective victims, interpret failures and decide what to try next.

It was not a laboratory demonstration. The targets were real.

It was not, however, the arrival of an infallible machine hacker. The autonomous attacks reconstructed by Palo Alto Networks’ Unit 42 did not successfully compromise their intended targets. The agent found vulnerable software versions, but the configurations needed by its borrowed exploits were missing. Authentication controls and disabled features stopped it. When the actor did achieve confirmed compromises, the evidence indicates that those operations used more conventional, manually directed techniques.

That distinction is the center of the story.

The machine did not conquer the internet. It did something less cinematic and potentially more important: it absorbed a large portion of the repetitive work that occurs before a successful intrusion. It searched, sorted, downloaded, tested, rejected and retargeted. It reduced a sprawling field of possible victims to a smaller set worth an operator’s attention.

The human hacker had begun to look less like the person at the keyboard and more like the supervisor of a machine that never became bored.

An Open Door into the Attacker’s Workshop

Unit 42 did not reconstruct the campaign from a few suspicious network packets or from malware recovered after a breach. The researchers were handed a far more revealing opportunity by the attacker’s own automated system.

In response to a Telegram instruction, Hermes Agent started a basic Python web server on port 8888. Instead of serving files from a carefully isolated staging directory, it started the server in the operator’s home directory. That exposed the contents of the workspace.

The resulting view appears to have included exploit scripts, target lists, application programming interface keys, shell-command history, AI-tool configurations and logs from an autonomous exploitation session. It was the cyber-espionage equivalent of leaving a workshop door open with the notebooks, tools and partly completed jobs still spread across the benches.

The mistake is especially instructive because the operator was not indifferent to operational security. According to Unit 42, exploit directories had sometimes been cleared after use. Western AI tools were routed through a third-party proxy. Local response storage had been disabled for Codex, and attribution-related settings had been changed in Claude Code. The actor understood that activity could leave evidence.

Yet the agent itself created the exposure.

This is one of the underappreciated complications of delegating operations to autonomous software. The system does not merely inherit the operator’s capabilities. It also introduces its own judgment errors. A human who knows that a home directory contains sensitive material may instinctively create a clean directory before starting a file server. An agent completing the narrower instruction “serve these files” may select the shortest technically valid method and inadvertently publish far more than intended.

Autonomy magnifies productivity, but it can also magnify small misunderstandings into operational failures. In this case, the attacker’s AI infrastructure became an intelligence source for the defenders studying it.

A Hacker’s Collection of Models

The exposed environment showed that the operator was not committed to one artificial-intelligence provider. It resembled a workshop in which several models were being compared for different tasks.

DeepSeek, operating through Hermes Agent, was the principal reasoning engine during the autonomous attack session. The actor also configured models from Qwen, GLM, Kimi and MiniMax. Unit 42 found limited testing of Claude Code for connectivity and proxy validation. It found signs that Codex had been granted access to exploit-development directories, although the relevant conversations had not been retained and the researchers could not establish exactly what it had done there.

That limitation matters. The presence of an AI tool in an exploit directory is not proof that the tool created an exploit or participated in an intrusion. Unit 42’s evidence for sustained autonomous offensive activity centers on DeepSeek and Hermes Agent, not on the mere installation of every model found in the environment.

The actor had altered local permission settings to minimize interruption. Claude Code had been launched with permission checks bypassed and a collection of tools explicitly allowed. A Qwen coding interface was placed in a permissive approval mode. The Hermes framework had no built-in safety system of its own and had been equipped with red-team-oriented skills.

Provider-side safeguards still mattered. OpenAI told Unit 42 that its systems refused requests violating policy and eventually disabled an account believed to be connected with the campaign. Local settings such as disabling response storage did not disable the provider’s independent safety monitoring. The operator’s experiments therefore did not establish that all models were equally usable for offensive work.

The practical lesson is more uncomfortable than the claim that one particular model has been “jailbroken.” An attacker does not need every model to cooperate. The emerging ecosystem is modular. If one service refuses a task, the operator can change models, use a proxy, replace the orchestration framework, supply different tools or divide the operation into smaller requests that appear less conspicuous in isolation.

The relevant unit is no longer the model alone. It is the entire system surrounding it.

What Made the Agent an Agent

A conventional chatbot produces an answer and waits for another question. An agent operates in a loop.

It receives an objective, decides what action might advance that objective, invokes a tool, reads the result and chooses the next action. Given terminal access, it can run software. Given an internet-search interface, it can locate systems. Given a vulnerability scanner, it can test them. Given persistent storage, it can preserve useful procedures for future sessions.

Hermes Agent supplied this orchestration layer. DeepSeek supplied much of the reasoning. Telegram gave the human operator a remote control channel.

The actor had also added several specialized skills. One instructed the system in the use of FOFA, a search engine that indexes internet-accessible systems and services. Another addressed WebSocket exploitation. The environment incorporated a Model Context Protocol server that exposed FOFA searches, generated Nuclei vulnerability scans and translated ordinary language into search queries.

Model Context Protocol, or MCP, is designed to give AI systems standardized access to outside tools and data. In a legitimate environment, an MCP connection might let an assistant consult a database, modify a project or operate a business application. In the attacker’s environment, the same architectural idea connected a language model to an internet asset index and security-testing utilities.

Nothing in that arrangement was science fiction. The individual components were publicly available. The model did not require a secret offensive version trained in an intelligence laboratory. The sophistication lay in the assembly: a general reasoning model, an agent framework, several custom skills, internet reconnaissance, public exploit repositories, a command shell and a messaging application.

The operator had built a pipeline through which instructions could become actions.

The First Hunt: Langflow

The most complete recovered autonomous session began with Langflow, an open-source platform used to construct applications and workflows around language models.

The agent selected CVE-2026-33017, an unauthenticated remote-code-execution vulnerability affecting exposed Langflow installations under particular configurations. It downloaded a public proof of concept from GitHub, used FOFA to identify 84 accessible Langflow systems and ran a multithreaded scanner against the resulting list.

One system appeared to be running Langflow 1.3.4, a vulnerable version.

That sounds like the point at which the machine breaks in. It did not.

The exploit required either Langflow’s automatic-login option to be enabled or a publicly accessible flow identifier. The candidate systems did not provide the required condition. The vulnerable code was present, but the path needed to reach it was not.

This is an essential lesson in reading both vulnerability reports and claims of AI-enabled exploitation. A version number is not the same as exploitability. Public proof-of-concept code is often written for a particular configuration. It may depend on an exposed endpoint, an optional feature, an existing account, an uploaded file, a known identifier or a sequence of environmental assumptions that ordinary vulnerability scanning cannot establish.

The agent recognized the problem. According to the recovered log, it concluded that the small population of exposed Langflow systems and the missing prerequisites made the product a poor target. It abandoned the effort and began looking for something better.

This was the genuinely agentic moment.

A simple scanner would have completed its list and returned a set of results. A fixed automation script might have tried the same request against every address regardless of outcome. DeepSeek instead interpreted why the exploitation had failed, reconsidered the value of the target class and initiated a new research phase.

The attack had not succeeded, but the agent had performed a decision ordinarily made by a human operator.

Searching for a Better Victim

After dropping Langflow, the agent surveyed ten product families. It compared their visible deployment populations and searched GitHub for popular proof-of-concept repositories associated with recently disclosed vulnerabilities. It considered severity, apparent exposure and the availability of usable exploit code.

It chose n8n.

n8n is a workflow-automation platform that connects services and moves information between them. Organizations use products of this kind to link databases, messaging platforms, cloud services, ticketing systems and internal applications. That makes an exposed workflow server more than an ordinary web application. It may hold credentials and trusted connections reaching deeply into the organization that operates it.

The agent located public code chaining two serious vulnerabilities. CVE-2026-21858 could disclose files through certain form-based workflows. CVE-2025-68613 involved an expression-injection weakness capable of escaping the intended sandbox and reaching code execution. Used together under the correct conditions, the chain could move from unauthenticated file access toward control of the underlying server.

The agent read the version ranges and correctly reasoned that an installation running n8n 1.117.3 would fall within the affected range for both components. It then searched for exposed instances, sampled the much larger result set, probed systems for version information and examined accessible form endpoints.

Unit 42’s report cites a FOFA result of more than 647,000 n8n instances worldwide, including more than 25,000 in China. Such search-engine totals should not be interpreted as a precise count of distinct vulnerable servers. Internet indexes can include stale observations, shared infrastructure, duplicate services and systems that merely resemble a product. The actor’s own later sampling demonstrated the gulf between a large search result and an exploitable population.

DeepSeek narrowed the Chinese results to approximately one hundred addresses and probed roughly forty distinct systems. It found three running versions that appeared vulnerable. One exposed several forms.

Again, the machine seemed close.

Again, configuration stopped it. The available exploit required an unauthenticated form accepting a file upload. The forms the agent found required authentication. It launched additional parallel checks against more than fifty targets but did not find the prerequisite it needed.

The recovered autonomous session ended without a compromise.

Failure with Consequences

Calling the episode a failed attack is accurate. Calling it unimportant would be a mistake.

The agent had taken a general objective and performed a coherent sequence of offensive tasks: asset discovery, vulnerability selection, exploit acquisition, version analysis, target sampling, prerequisite validation and retargeting. It reduced an enormous internet search to a few systems with the right software versions and then tested whether their configurations completed the attack path.

It also refrained from wasting unlimited resources on the whole population. Unit 42 observed it sampling and narrowing the target set, apparently managing its own compute consumption. That behavior matters because autonomous systems are constrained by cost, context windows, rate limits and noisy results just as human campaigns are constrained by time and personnel.

An attacker does not necessarily need the agent to succeed independently. If the machine eliminates thousands of unsuitable targets and presents the operator with three unusually promising ones, it has already changed the economics of the campaign.

Security discussions often frame AI risk as a contest over whether a model can invent a zero-day vulnerability or independently conduct a complete intrusion. Those are important thresholds, but they are not the only ones that matter. Most real attackers do not require novel vulnerabilities. They exploit known flaws, exposed systems, weak identity controls and delayed patching.

A system capable of reliably automating the tedious middle of that process can make an ordinary attacker faster and broader without making the attacker brilliant.

Where the Human Still Mattered

The same exposed workspace contained evidence of manual operations against Citrix NetScaler, Apache Tomcat, Marimo notebook servers, Windows Internet Key Exchange endpoints and other systems.

Those operations produced the confirmed damage that the autonomous session did not.

Unit 42 found evidence that the actor exfiltrated memory from three organizations through a NetScaler vulnerability and searched the recovered material for authentication cookies. The behavior suggested an effort to hijack active sessions. The actor also achieved command execution on eleven exposed Marimo notebook instances and attempted reverse shells against Tomcat and VPN targets.

Across both autonomous and manual activity, Unit 42 identified attempts against more than 460 targets. It could confirm three successful compromises, all involving NetScaler memory extraction. It also saw signs of batch exploitation against an unknown number of hosts contained in a file that the actor had deleted before researchers obtained access.

The most deliberate activity focused on a government organization in Malaysia. The operator returned repeatedly over several days, adjusted memory-grooming parameters, maximized read attempts and later used proxy infrastructure to obscure the source.

This persistence looks different from the recovered AI session. It suggests human attention, refinement and intent. The autonomous agent searched opportunistically across broad populations. The manual operator concentrated effort where the prospective return appeared higher.

That may be the more realistic near-term division of labor. Machines handle breadth; people handle depth. The agent surveys, tests and ranks. The human intervenes when a target is valuable, when an exploit becomes temperamental or when post-compromise decisions require an understanding of risk and consequence.

The hacker has not disappeared. The hacker’s span of control has expanded.

Who Was Behind It?

Unit 42 describes the operator as a Chinese-speaking actor based in Zhuhai who presented himself as a binary-security researcher. The attribution rests partly on GitHub activity and the maintenance of a vulnerability-intelligence project called 1DayNews.

That system reportedly aggregated remote-code-execution disclosures from seventeen sources, used DeepSeek to filter them for apparent exploitability and distributed alerts through Telegram. It therefore complemented the autonomous exploitation environment: one system watched for new opportunities while another could investigate and act upon them.

The observed target selection was largely opportunistic. Confirmed victims spanned three countries and several sectors. Autonomous searches included Chinese domestic infrastructure, while the Malaysian government target received more sustained manual attention.

None of this establishes that the operator acted for the Chinese government. Location, language and targeting are not sufficient evidence of state direction. The campaign is better understood from the available record as the work of an opportunistic exploit operator experimenting with autonomous capability.

That restraint is important. AI-generated attacks will further complicate attribution because operators can swap models, route activity through international infrastructure and allow agents to make some targeting decisions themselves. A Chinese model may be used by a European criminal. A Western coding assistant may appear in a state-linked operator’s development directory. A target country may reflect the search engine’s results rather than strategic intent.

The model’s nationality is not the attacker’s identity, and the agent’s choice is not automatically the operator’s policy.

Autonomous, Automated or Merely Assisted?

The vocabulary around AI attacks is already deteriorating.

A criminal who asks a chatbot to rewrite a phishing message is using AI assistance. A script that scans a predetermined list and launches the same exploit against every address is automated. An agent that interprets results, changes its plan and selects a new target class without receiving another instruction displays a more meaningful form of autonomy.

The Unit 42 case crosses that third threshold, but only within a limited operational frame. The agent did not define the campaign’s ultimate purpose. A human assembled the environment, granted the tools, supplied the offensive skills and initiated the task. The agent then exercised discretion inside that enclosure.

This is delegated autonomy, not independent intention.

The distinction does not make the capability harmless. Many dangerous systems operate within objectives established by people. A cruise missile does not need political ambition to alter warfare. An automated trading system does not need a theory of economics to destabilize a market. What matters is the combination of authority, speed, access and error.

Here, the agent possessed enough authority to issue internet searches, download code, execute commands and send exploit traffic to real organizations. It could do so faster and more persistently than a person performing each step manually. It could also make mistakes at that speed, including the file-server error that exposed the operation itself.

The relevant question is therefore not whether the machine was “really a hacker.” It is how much operational discretion one person can safely—or maliciously—delegate to software.

The Shrinking Defensive Interval

Public vulnerability disclosure has always started a race. Vendors release patches and advisories. Researchers publish analysis. Defenders inventory systems and schedule maintenance. Attackers read the same material, obtain proof-of-concept code and begin searching for exposed targets.

Agentic systems can shorten several stages of the attacker’s side of that race.

They can monitor disclosure feeds continuously, rank vulnerabilities by reachability and consequence, locate public exploit repositories, interpret version ranges and build search queries. They can test small samples, discard poor candidates and scale effort toward the populations most likely to produce a result.

The Unit 42 agent was imperfect at each of these tasks. It treated GitHub stars as a clue to a proof of concept’s importance and possibly its exploitation—a useful shortcut, but hardly reliable intelligence. It relied on FOFA counts that did not translate directly into live, vulnerable systems. It downloaded public tools whose prerequisites sharply limited their usefulness.

But an imperfect analyst operating in minutes can still create pressure that a slow defensive process cannot absorb.

The consequence is not necessarily a world in which every newly disclosed vulnerability is exploited instantly. It is a world in which attackers can evaluate far more disclosures and abandon unproductive avenues much sooner. The automation becomes valuable not because every attempt works, but because failure becomes cheap.

Defending Against the Supervisor Model

There is no special “AI packet” that identifies an agent-driven intrusion. The traffic still consists of searches, web requests, version probes and exploit attempts. The vulnerabilities remain ordinary software vulnerabilities. The compromised server does not care whether the request was composed by a person, a Python script or a language model.

The most immediate defensive measures are therefore familiar.

Internet-accessible administrative, development and workflow systems require accurate inventory and an explicit business justification for their exposure. Langflow, n8n, notebook platforms and similar tools may contain execution features, stored secrets and connections to other services. They should not be treated as harmless web dashboards.

Patch speed matters, but configuration mattered just as much in this campaign. The agent found software versions that appeared vulnerable and still failed because automatic login was disabled, public flow identifiers were absent or forms required authentication. Those controls did not make the underlying vulnerabilities acceptable, but they broke the documented exploit chains.

That is defense in depth doing precisely what it is supposed to do.

Organizations should also watch for reconnaissance spread across many sources or arriving in compressed bursts. An agent may change user agents, tools and request patterns as it reasons through a problem, creating activity that looks less uniform than a conventional mass scanner. Correlating repeated version queries, endpoint discovery and malformed requests at the service level may be more useful than waiting for one canonical exploit signature.

Rate limits and temporary blocks can increase the cost of autonomous probing. Strong authentication on workflow endpoints can eliminate prerequisites assumed by public proof-of-concept code. Network segmentation can prevent compromise of an exposed application from becoming access to its databases, cloud credentials and connected services.

Defenders should also reassess disclosure-response timelines. A process designed around weekly patch meetings may be structurally mismatched to adversaries that can ingest an advisory, locate exploit code and begin target selection within minutes.

The Machine’s First Day at Work

The temptation is to place this campaign at one of two extremes.

The first is sensationalism: artificial intelligence has become an autonomous super-hacker, and human defenders are already obsolete.

The second is complacency: the autonomous attacks failed, so the entire episode is little more than a vendor’s attempt to attach AI to familiar vulnerability scanning.

Neither interpretation survives contact with the evidence.

The agent was not a master intruder. It depended on public exploits, imperfect internet indexes and configuration assumptions it could not overcome. It did not demonstrate autonomous zero-day discovery. It did not complete a successful end-to-end compromise in the recovered session. Human-led operations were still responsible for the campaign’s confirmed impact.

But the system did perform real offensive work against real targets with limited continuing direction. It recognized failure, researched alternatives and redirected its efforts. Its operator had built persistent infrastructure for repeating that cycle and was experimenting with multiple models, proxy arrangements and permissive tool configurations.

The barrier to assembling such a system was not exceptionally high. The essential components—models, agent frameworks, messaging platforms, internet search services, scanners and exploit repositories—already exist. Their integration will improve. Future agents will handle longer contexts, use tools more reliably, preserve experience across campaigns and become better at testing exploit prerequisites before firing code at a target.

They will also continue to make mistakes.

That last point should not be comforting. Human attackers make mistakes too. Security is rarely determined by whether an adversary is flawless. It is determined by whether the adversary can attempt enough operations, cheaply enough, to find the organizations whose defenses contain the corresponding mistake.

The most important change in this campaign was not the removal of the hacker. It was the change in the hacker’s job.

One person could supervise an automated worker that searched the internet, read vulnerability research, collected weapons, tested doors and moved on when they remained closed. The machine failed to enter the buildings examined in the recovered session. Meanwhile, it mapped the neighborhood, tried the locks and learned which kinds of doors were worth approaching next.

And when it made its own operational-security mistake, it briefly turned the lights on inside the workshop.

That glimpse should be taken seriously—not because it revealed a finished autonomous cyber weapon, but because it showed one being assembled from parts almost anyone can obtain.

Sources

Palo Alto Networks Unit 42, “Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks,” July 30, 2026.

GitHub Security Advisory for CVE-2026-21858, n8n arbitrary file-read vulnerability.

GitHub Security Advisory for CVE-2025-68613, n8n expression-injection and remote-code-execution vulnerability.

Public research repository for the n8n CVE-2026-21858 and CVE-2025-68613 exploit chain.

Public research repository for CVE-2026-33017 affecting Langflow.

Nous Research, Hermes Agent project documentation.

Jonathan Lockhart is a cybersecurity researcher and investigative journalist at bordercybergroup.com.

If you would like to support our work — useful, well-researched, ad-free cybersecurity intelligence — subscribe, comment, or buy us a coffee! Thanks.