The Operator Didn’t Hack the Network. The AI Planned the Attack
- Javier Conejo del Cerro
- hace 14 horas
- 2 min de lectura
Artificial intelligence is no longer limited to assisting defenders or accelerating software development. Researchers from Palo Alto Networks’ Unit 42 have uncovered a campaign in which a Chinese-speaking threat actor leveraged DeepSeek through the open-source Hermes Agent framework to autonomously search for vulnerable systems, select exploits, adapt attack paths, and execute operations after receiving a single instruction via Telegram.
The operation demonstrates how AI agents are evolving from productivity tools into autonomous offensive assistants capable of making tactical decisions with minimal human oversight.
Phase 1 – Autonomous Reconnaissance
Following a single Telegram command, Hermes Agent used DeepSeek to enumerate internet-facing systems, inspect software versions, search for public exploit code, and prioritize targets based on exposure, severity, and exploitability.
Rather than following predefined instructions, the agent dynamically evaluated multiple attack paths before selecting the most promising opportunities.
Phase 2 – Adaptive Exploitation
The AI attempted to exploit vulnerabilities affecting platforms such as Langflow and n8n, automatically abandoning unsuccessful techniques when environmental conditions prevented exploitation. It then pivoted to alternative vulnerabilities without requiring additional operator guidance.
Separate manual activity also targeted NetScaler appliances and Marimo instances, demonstrating a hybrid model where autonomous AI workflows complemented traditional intrusion techniques.
Phase 3 – Operational Exposure
Ironically, the campaign was exposed by the attacker’s own infrastructure. Hermes Agent unintentionally launched a Python HTTP server that revealed configuration files, API keys, exploit scripts, target lists, shell history, and detailed autonomous execution logs.
These artifacts provided rare visibility into how a reasoning model can independently conduct reconnaissance, evaluate exploits, and orchestrate offensive workflows.
Phase 4 – AI Becomes an Offensive Operator
While the campaign achieved limited technical success, its strategic significance is far greater than the number of compromised systems.
The operation illustrates how AI agents can already:
Discover exposed infrastructure.
Select suitable vulnerabilities.
Retrieve public exploits.
Adapt when attacks fail.
Continue operations without continuous human control.
This represents a fundamental shift from automated tooling toward autonomous offensive decision-making.
Defense Measures
Organizations should prioritize:
Prompt patching of vulnerable Langflow, n8n, Marimo, and customer-managed NetScaler deployments.
Removing unnecessary internet exposure from workflow automation and notebook platforms.
Continuous Attack Surface Management (ASM) and Continuous Threat Exposure Management (CTEM).
Monitoring AI-accessible infrastructure and enforcing strong authentication for exposed services.
Continuous validation to identify exploitable assets before autonomous attackers do.
Conclusions
Autonomous AI agents are no longer a theoretical risk—they are becoming practical offensive tools capable of accelerating every stage of the attack lifecycle.
The question is no longer whether attackers will use AI. The question is how quickly defenders can gain the same level of visibility and continuous validation before autonomous adversaries move faster than human response.
The Hacker News