Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks

Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks is a threat-research report published by Palo Alto Networks' Unit 42 on July 30, 2026 (Source: unit42.paloaltonetworks.com). It documents an AI-enabled hacking campaign in which the operator used DeepSeek, driven through the open-source Hermes Agent framework, as an autonomous offensive operator, and it is unusual among such disclosures in resting on the actor's own recovered session logs rather than on victim-side telemetry.

Its central finding runs against the framing the campaign has attracted in secondary coverage: the autonomous cycle worked as a research and targeting engine and achieved no compromise, while every confirmed impact traced to the actor's separate manual operations.

The actor

Unit 42 assesses the actor as a Chinese-speaking individual based in Zhuhai, China, operating under the aliases knaithe and KnYuan, and characterises them as "an opportunistic exploit operator and self-described binary security researcher." The assessment rests on the actor's GitHub activity, including maintenance of 1DayNews, an automated vulnerability-intelligence pipeline that aggregates remote-code-execution disclosures from 17 sources — primarily network-perimeter vendors — uses DeepSeek to filter for exploitability, and distributes alerts by Telegram.

The report does not describe the actor as state-sponsored or state-affiliated. Confirmed victims span three countries and multiple sectors. The autonomous campaigns targeted Chinese domestic infrastructure indiscriminately; the manual campaign against a Malaysian government entity showed higher intent, with refined exploitation parameters and proxy anonymisation sustained over multiple days.

How the operation was exposed

Unit 42 obtained its visibility because the agent exposed the operation itself. Responding to a Telegram command, Hermes Agent started an HTTP file server (python3 -m http.server 8888) from the actor's home directory rather than an isolated staging directory, publishing the entire workspace: AI tool configurations, API keys, exploit scripts, target lists, bash history, and the autonomous session logs. The report states the exposure was unintentional and notes that the actor showed operational-security awareness elsewhere, emptying exploit directories after use and disabling conversation logging.

Unit 42 draws this out as a finding in its own right: autonomous execution "introduces novel operational security risks for threat actors," producing forensic artefacts that manual execution would not have created.

Tooling and model selection

The actor ran four AI coding tools and routed the two Western ones through a third-party proxy (code.newcli[.]com) to reduce traceability, accessing DeepSeek and Qwen directly through native API endpoints.

Western tool use was marginal and consistent with market evaluation rather than operational reliance. Claude Code's recovered session history held ten entries across three sessions, containing only model checks, connectivity tests and one package install. Codex chat logs were not recoverable because the actor had disabled local response storage, though exploit-development directories were marked as trusted. Unit 42 notes that the client-side settings the actor changed do not affect server-side controls, and records that OpenAI confirmed its provider-side safeguards refused policy-violating requests and that continued attempts led its safety systems to flag and disable an account believed linked to the campaign, before Unit 42's intelligence sharing.

The report reads the model choice as following the path of least resistance: the actor "selected a model with minimal safety controls (DeepSeek) accessed through an open-source framework with no client-side restrictions," having attempted Western models whose provider-side controls "likely limited their effectiveness for autonomous attacks."

Hermes Agent was customised with three red-teaming skills — godmode (framework-bundled jailbreaking), web-terminal-exploitation (custom), and fofa-cyberspace-search (a template directing DeepSeek to the actor's own FOFA enumeration script) — and integrated an open-source FofaMap Model Context Protocol server exposing FOFA asset search, Nuclei scan generation, and a DeepSeek-powered natural-language-to-FOFA query translator.

The autonomous cycle, in four phases

The recovered sequence comes from a single Hermes Agent session dated May 7, 2026; operator input beyond the initial task was not recoverable.

1. Langflow. DeepSeek identified CVE-2026-33017 (CVSS 9.8), downloaded the public proof of concept, enumerated 84 Langflow instances via FOFA, ran the scanner and found one vulnerable target running Langflow 1.3.4. Exploitation failed: the vulnerability requires either auto_login enabled or a public flow ID, and the target had neither. The agent then wrote off the product family — "Deployments small (84 alive), exploitable probably 0. Search for larger-scale vulns."
2. Autonomous CVE research. DeepSeek surveyed deployment counts across ten product families via FOFA, searched GitHub for trending 2026 CVE proof-of-concept repositories sorted by stars, and ranked candidates by severity, deployment footprint and exploitability before selecting n8n. FOFA returned 647,017 n8n instances globally and 25,209 in China.
3. Exploit acquisition. The agent obtained a public proof of concept chaining CVE-2026-21858 (arbitrary file read, CVSS 10.0) and CVE-2025-68613 (sandbox bypass to remote code execution, CVSS 9.9), and reasoned about affected version ranges to identify which builds were exploitable by both.
4. Enumeration and attempts. Of the 25,209 Chinese instances, DeepSeek sampled roughly 100 IP addresses and probed about 40, checking versions by curl. Three ran vulnerable versions (v1.18.0, v1.117.3, v1.108.2). One exposed three form endpoints, but all required authentication, which the exploit chain does not tolerate — "it needs an UNAUTHENTICATED form with file upload. These forms have auth enabled." Parallel scanning across 50-plus remaining targets found no publicly accessible forms. No exploitation was achieved, and the recovered session ends there.

Unit 42 reads the sampling as the agent managing its own compute budget, and notes that the process "executed hundreds of hours of manual targeting analysis in mere minutes."

Manual campaigns and confirmed impact

The actor ran conventional operations in parallel — FOFA enumeration, custom Python scanners, direct exploitation — and these produced all the confirmed impact:

• Data exfiltration from three organisations via a Citrix NetScaler out-of-bounds memory read (CVE-2026-3055). The actor searched the exfiltrated memory for NetScaler authentication cookies (NSC_AAAC=), indicating session-hijacking intent, and returned to a Malaysian government entity over multiple days with memory-grooming parameters and maximum read attempts.
• Command execution confirmed on 11 Marimo notebook instances (CVE-2026-39987).
• Java deserialisation reverse-shell attempts against nine Apache Tomcat servers (CVE-2026-34486).
• Reverse-shell callbacks against three IKE VPN endpoints (CVE-2026-33824).

The actor also cloned a public proof of concept for CVE-2026-0300, a buffer overflow in the PAN-OS User-ID Authentication Portal, but the code is non-functional with placeholder values and Unit 42 found no evidence of modification or execution.

Across autonomous and manual activity the actor attempted more than 460 targets. Unit 42 notes it also saw evidence of batch exploitation against an unknown number of hosts listed in a file the actor deleted before analysis, so the confirmed-impact count is a floor.

Conclusions the report draws

Unit 42 states that although the autonomous campaigns "did not achieve full compromise of any of their intended targets," four implications follow. Autonomous attack cycles are operationally viable and the margin of failure was narrow — exploitation was prevented by target-side configuration (a missing workflow prerequisite, and authentication on form endpoints), so "targets with weaker default configurations would have been susceptible." Threat actors are building persistent AI offensive infrastructure rather than using tools in isolation, assembling custom skills, MCP integration, proxy anonymisation and Telegram command and control designed to retain and reuse procedures across sessions. Actors follow the path of least resistance in model choice. And autonomous execution creates operational-security exposure for the attacker.

Its closing position is that "the significance of these findings lies in the trajectory rather than the outcome of any individual campaign," and that the technical barrier to AI-augmented offensive operations "is low and continues to decrease."

Provenance and limits

Published on Unit 42's own domain with page metadata giving July 30, 2026 and Unit 42 as author. The report rests on a single exposed workspace and one fully recovered autonomous session; the actor's Codex logs were unrecoverable, additional operator input in the May 7 session was not recovered, and a target list was deleted before analysis. The Palo Alto Networks product-protection and incident-response sections that close the post are vendor promotion and carry no research finding.

Relationships

• supports: Autonomous cyber-agents — an empirical anchor on how much of an AI-enabled campaign is actually autonomous.
• related: DeepSeek — the model used as the reasoning engine, chosen for minimal safety controls.
• related: Palo Alto Networks — the publisher; the report also records a non-functional proof of concept for a PAN-OS vulnerability.
• related: Open-Weight Frontier Models — the report's path-of-least-resistance finding turns on provider-side controls being absent from the chosen stack.
• related: Agentic harnesses and capability elicitation — capability came from the harness, its skills and its MCP integrations rather than from model scale.
• related: AI and Cybersecurity — the autonomous cycle produced no compromise, which bears against readings that treat AI-enabled campaigns as already achieving end-to-end intrusion.