DeepSeek used for an autonomous attack campaign after Claude and Codex refused

What happened

A Zhuhai-based threat actor using the aliases knaithe and KnYuan wired DeepSeek into the open-source Hermes Agent framework, drove it from a single Telegram command, and ran an autonomous scan-research-exploit pipeline against more than 460 internet-facing targets, staging or exploiting 7 CVEs across Langflow, n8n and Citrix NetScaler among others. Unit 42 report published 2026-07-30. (Unit 42)
The actor tried Claude Code and OpenAI's Codex first and both platforms' safety controls blocked the offensive use; the switch to DeepSeek, reached directly by API with no equivalent guardrail, is what made the campaign viable. The actor also tested Qwen, GLM, Kimi and MiniMax. (Unit 42)
Unit 42 calls this the first confirmed real-world evidence both that autonomous AI-driven attack cycles are operationally viable and that provider-side safety controls have measurable defensive value. (Unit 42)
The campaign was discovered only because Hermes accidentally exposed a web server from its own home directory, leaking API keys, exploit scripts and attack logs. (Unit 42)
This was caught two days late — the Unit 42 report is dated 07-30, and today's entry is the first record of it here.

Sources 1

Unit 42 unit42.paloaltonetworks.com primary source

Credibility ratings combine two public datasets: Lin et al. 2023, PNAS Nexus 2(9):pgad286 (CC BY 4.0) for the domain-quality score, and Wikipedia's perennial-sources list (CC BY-SA 4.0) for the reliability tier. A rating describes an outlet's general record, never this particular article. Unrated means absent from those datasets — not a judgement.

The wider story

This event sits inside China's Stack, which carries how it developed before and since.

Story 13 of 39 in this thread's timeline, oldest to newest

Adjacent threads (shared entities):

· Distillation Fight