A hacker based in Zhuhai, China, wired the AI model DeepSeek into an open-source automation tool and let it scan, rank, and attack hundreds of internet-facing servers with little more than a single Telegram command, according to a new report from Palo Alto Networks’ Unit 42.

A single command, hundreds of targets

Researchers say the actor, tracked under the aliases “knaithe” and “KnYuan,” connected DeepSeek to Hermes Agent, an open-source AI agent framework that gives a model terminal access, a Telegram-based command channel, and a library of pre-built attack “skills.” Once wired together, a single instruction let DeepSeek handle reconnaissance, target ranking, and exploit selection largely on its own. Unit 42 says the actor attempted to compromise more than 460 systems this way, evaluating widely used tools such as n8n and Langflow before narrowing in on the most exposed targets.

Most of those autonomous attempts stalled — DeepSeek’s own assessment of one batch of Langflow servers concluded “deployments small … exploitable probably 0.” But the same operator separately and manually exploited three Citrix NetScaler appliances and 11 Marimo notebook servers using known vulnerabilities, exfiltrating data from at least one victim.

Why DeepSeek, not Claude or Codex

According to the report, the actor also tested Qwen, GLM, Kimi, MiniMax, and Anthropic’s Claude Code before settling on DeepSeek, largely because it carried the fewest built-in safety restrictions. Unit 42 notes that guardrails on Claude and OpenAI’s Codex “likely limited autonomous attack effectiveness,” pushing the operator toward the least-restricted option. Anthropic separately disclosed that Claude models were used to breach three real companies earlier this year, though under tighter model-level controls than what Unit 42 describes here.

Caught by its own automation

The same autonomy that powered the attacks also exposed them. Investigators say the actor’s tooling briefly launched an HTTP file server from its own working directory, spilling API keys, target lists, and session logs — the kind of forensic trail that manual, human-run intrusions rarely leave. That log let Unit 42 reconstruct a full attack cycle from a May 2026 session.

Unit 42 stopped short of calling the campaign fully autonomous — a human still issued the opening instructions — but concluded that “the margin of failure was narrow”: exploitation was blocked mainly by target-side configuration, not by any fundamental limit on what the AI could do. The case adds to a growing body of research on agentic malware, where AI systems carry out attack chains with minimal step-by-step human direction, and raises fresh questions for how security teams monitor which AI models touch their infrastructure.