Palo Alto Networks' Unit 42 discovered a Chinese-speaking threat actor leveraging DeepSeek AI through the open-source Hermes Agent framework to conduct autonomous cyberattacks. The attacker, tracked as knaithe/KnYuan, issued a single Telegram command that enabled the AI agent to independently identify internet-facing systems and deploy public exploits without further human intervention.
Palo Alto Networks' Unit 42 says a Chinese-speaking threat actor used DeepSeek through the open-source Hermes Agent framework to launch attacks autonomously. After an initial Telegram instruction, the agent found internet-facing systems and selected public exploits. The researchers recovered no further operator input in the session. The operator, tracked through the aliases knaithe and KnYuan,
Originally published at thehackernews.com
60-minute technical evaluation, no obligation. We'll map the ideas in this article to your environment.
