{"schema_version":"0.10.0","id":"LR-2026-0610","record_version":1,"title":"Hacker uses DeepSeek agent to autonomously attack vulnerable servers","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":68.3,"score_breakdown":{"source_authority":12.1,"independent_corroboration":20.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":6.0,"completeness":8.0,"unhedged_language":4.79},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-01","extraction_run_id":null,"evidence_level":{"level":"confirmed","reason":"3 independent outlets","original_document":null,"reports_total":3,"reports_independent":3,"reports_derivative":0,"developing":false,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-01","history":[{"date":"2026-11-01","from_level":null,"to_level":"confirmed","reason":"3 independent outlets"}]},"sources_hash":"b53019b5c68e311c8923ba100ff078275dd5d42bed17ab2d168451796ee4ac2d"},"system":{"model_name":"DeepSeek","model_version":null,"developer":"unknown","harness":"Hermes Agent","tools_granted":["operating system terminals","running commands","internet connection"],"permissions_scope":null,"autonomy_level":"full-auto","guardrails_present":[],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":"loosened local safeguards","production_intended":null},"event":{"date_occurred":"2026-05-01","date_occurred_precision":"month","date_disclosed":"2026-07-31","incident_class":"security_compromise","failure_class":null,"agent_involved":true,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"third_party","summary":"A Chinese-speaking threat actor used the DeepSeek model inside the open-source Hermes Agent framework to run offensive operations against internet-exposed systems. After an initial operator task, the agent searched for targets, downloaded public exploits and attempted attacks on Langflow and n8n. Those attempts failed because the exposed systems did not meet the exploits' requirements. The same operator conducted separate manual attacks on more than 460 systems, with three confirmed compromises. Hermes accidentally started a web server from its home directory, exposing the operator's keys, exploit scripts, target lists and logs. Palo Alto Networks' Unit 42 discovered the activity and reported it on 2026-07-31.","tags":[],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":"Yolo mode let the agent execute risky commands without first requesting operator permission","failure_class_detail":null,"responsible_party":null,"adversarial_actor":"external_attacker","input_provenance":"Instructions from a Telegram channel","time_to_contain":null,"operations_paused":null,"remediation":null,"precursor_events":"Earlier Hermes-linked incident exposing an alleged cyberattack against Thailand's Ministry of Finance","primary_risk":"RK07","secondary_risks":["RK02"],"control_chain":[{"layer":"L3","party":"attacker","party_name":null,"control_id":"B1","outcome":"missing","reason":null,"quote":"The agent supports a \"Yolo\" mode that allows it to operate and execute commands, even risky ones, without first requesting permission from its operator.","source_index":0,"reviewed":false}],"remediations":[{"by":null,"kind":"advice","date_reported":null,"controls_added":["J1"],"quote":"Organizations should patch exposed Langflow, n8n and Marimo systems, along with customer-managed NetScaler ADC or Gateway appliances configured as Security Assertion Markup Language (SAML) identity providers.","source_index":1,"reviewed":false}]},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"moderate","severity_because":"Moderate test met: data and systems of others were touched, and the scope is bounded to three confirmed compromises","harm_class":["third_party_security"],"affected_description":"Three confirmed compromises: memory data exfiltration from Citrix NetScaler and suspected session hijacking against a Malaysian government entity","protected_class_involved":null,"data_categories_exposed":[],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.bleepingcomputer.com/news/security/hacker-uses-deepseek-ai-to-autonomously-attack-vulnerable-servers/","publisher":"BleepingComputer","date":"2026-07-31","type":"press","title":"Hacker uses DeepSeek AI to autonomously attack vulnerable servers - BleepingComputer","archived_url":null,"attachment":"first_report","independence":"independent"},{"url":"https://thehackernews.com/2026/07/chinese-hacker-commands-deepseek-via.html","publisher":"The Hacker News","date":"2026-07-31","type":"press","title":"Chinese Hacker Commands DeepSeek via Telegram to Launch Autonomous Attacks - The Hacker News","archived_url":null,"independence":"independent"},{"url":"https://gbhackers.com/hacker-uses-deepseek-agent/","publisher":"GBHackers News","date":"2026-07-31","type":"press","title":"Chinese-Speaking Hacker Uses DeepSeek Agent to Launch Autonomous Cyberattacks - GBHackers News","archived_url":null,"independence":"independent"}],"per_field_confidence":{"system.model_name":"C","system.harness":"C","system.tools_granted":"C","system.autonomy_level":"C","system.safeguard_state":"C","event.date_occurred":"C","event.incident_class":"C","event.agent_involved":"C","event.detection_method":"C","event.root_cause_detail":"C","event.adversarial_actor":"C","event.input_provenance":"C","event.precursor_events":"C","impact.harm_class":"C","impact.affected_description":"C","impact.severity":"D","impact.severity_because":"D","event.primary_risk":"D","event.secondary_risks":"D","event.control_chain":"C","event.remediations":"C","event.summary":"C","system.deployment_context":"D","event.trigger":"D","context.country":"D","system.developer":"D","event.date_disclosed":"D","context.denominator_available":"D"},"field_citations":{"system.model_name":[{"source_index":0,"quote":"A Chinese-speaking threat actor is using the DeepSeek AI model and the open-source Hermes Agent to conduct autonomous cyberattacks on exposed servers with limited human involvement."}],"system.harness":[{"source_index":0,"quote":"The threat actor used DeepSeek as the reasoning engine behind Hermes Agent, an open-source AI framework capable of interacting with operating system terminals, running commands, and connecting to the internet."}],"system.tools_granted":[{"source_index":0,"quote":"The threat actor used DeepSeek as the reasoning engine behind Hermes Agent, an open-source AI framework capable of interacting with operating system terminals, running commands, and connecting to the internet."}],"system.autonomy_level":[{"source_index":0,"quote":"Unit 42 recovered a May 2026 session in which the operator appears to have provided only an initial task, after which the agent conducted the remaining activity autonomously without human feedback."}],"system.safeguard_state":[{"source_index":2,"quote":"The exposed environment showed four AI coding tools configured with loosened local safeguards and routed through anonymizing infrastructure."}],"event.date_occurred":[{"source_index":1,"quote":"In a recovered May 2026 session, DeepSeek downloaded a public exploit for the Langflow code-injection flaw CVE-2026-33017, enumerated 84 instances through FOFA, and found one target running version 1.3.4."}],"event.incident_class":[{"source_index":0,"quote":"A Chinese-speaking threat actor is using the DeepSeek AI model and the open-source Hermes Agent to conduct autonomous cyberattacks on exposed servers with limited human involvement."}],"event.agent_involved":[{"source_index":0,"quote":"The threat actor used DeepSeek as the reasoning engine behind Hermes Agent, an open-source AI framework capable of interacting with operating system terminals, running commands, and connecting to the internet."}],"event.detection_method":[{"source_index":0,"quote":"The activity was discovered by Palo Alto Networks' Unit 42 researchers after Hermes accidentally created a web server from its home directory, exposing the attacker's environment, including API keys, exploit scripts, target lists, shell history, and AI attack logs."}],"event.root_cause_detail":[{"source_index":0,"quote":"The agent supports a \"Yolo\" mode that allows it to operate and execute commands, even risky ones, without first requesting permission from its operator."}],"event.adversarial_actor":[{"source_index":0,"quote":"A Chinese-speaking threat actor is using the DeepSeek AI model and the open-source Hermes Agent to conduct autonomous cyberattacks on exposed servers with limited human involvement."}],"event.input_provenance":[{"source_index":0,"quote":"Hermes was configured to accept instructions from a Telegram channel, use custom offensive-security skills, and integrate with the FOFA internet asset search engine."}],"event.precursor_events":[{"source_index":0,"quote":"The exposed AI campaign comes after another recently disclosed incident in which poorly secured Hermes infrastructure exposed details about an alleged cyberattack against Thailand's Ministry of Finance."}],"impact.harm_class":[{"source_index":2,"quote":"Across roughly 460 attempted targets, Unit 42 confirmed only three successful compromises, all involving memory data exfiltration from Citrix NetScaler and suspected session hijacking attempts against a Malaysian government entity."}],"impact.affected_description":[{"source_index":2,"quote":"Across roughly 460 attempted targets, Unit 42 confirmed only three successful compromises, all involving memory data exfiltration from Citrix NetScaler and suspected session hijacking attempts against a Malaysian government entity."}],"impact.severity":[{"source_index":2,"quote":"Across roughly 460 attempted targets, Unit 42 confirmed only three successful compromises, all involving memory data exfiltration from Citrix NetScaler and suspected session hijacking attempts against a Malaysian government entity."}],"impact.severity_because":[{"source_index":2,"quote":"Across roughly 460 attempted targets, Unit 42 confirmed only three successful compromises, all involving memory data exfiltration from Citrix NetScaler and suspected session hijacking attempts against a Malaysian government entity."}],"event.control_chain":[{"source_index":0,"quote":"The agent supports a \"Yolo\" mode that allows it to operate and execute commands, even risky ones, without first requesting permission from its operator."}],"event.remediations":[{"source_index":1,"quote":"Organizations should patch exposed Langflow, n8n and Marimo systems, along with customer-managed NetScaler ADC or Gateway appliances configured as Security Assertion Markup Language (SAML) identity providers."}],"event.summary":[{"source_index":0,"quote":"A Chinese-speaking threat actor is using the DeepSeek AI model and the open-source Hermes Agent to conduct autonomous cyberattacks on exposed servers with limited human involvement."},{"source_index":1,"quote":"The DeepSeek-led attacks against Langflow and n8n failed because the exposed systems did not meet the exploits' configuration requirements."},{"source_index":0,"quote":"While the AI agent was used extensively, the threat actor also conducted manual attacks against more than 460 systems using vulnerabilities affecting Citrix NetScaler, Apache Tomcat, Marimo Notebook, Windows IKE VPN, and other products."},{"source_index":1,"quote":"Hermes Agent exposed the operation by starting python3 -m http.server 8888 from /home/worker."},{"source_index":0,"quote":"The activity was discovered by Palo Alto Networks' Unit 42 researchers after Hermes accidentally created a web server from its home directory, exposing the attacker's environment, including API keys, exploit scripts, target lists, shell history, and AI attack logs."}]},"notes_on_gaps":"Not stated: developer of DeepSeek or Hermes, model version, permissions scope, lifecycle stage, deployment context, intended use, durations, time to contain, reversibility, country and industry of the affected parties. Discovery date is not stated; the occurrence is known only as a May 2026 session. The failure_class field is omitted because no source names a specific agent failure class. Source 1 reports data exfiltration from three organizations and command execution on 11 Marimo instances, yet also says only three successful targets were confirmed; the counts are unreconciled, so no affected-party count is entered. Operator location and identity are Unit 42 and press assessments that Source 1 says are not independently verified. Judgements made: severity set to moderate on the bounded three-compromise scope; trigger set to human_misuse because the threat actor directed the activity; root cause set to guardrail for the absent approval gate in Yolo mode; the 2026-07-31 date for the timeline entry is taken from the article date rather than a stated event date. [case created by the backfill: read by claude-haiku-5-5, backfill-2026-11-01.2, 2026-11-01; not yet reviewed] [2026-11-01: evidence level set: Confirmed (3 independent outlets)]"},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"went_wrong","text":"Attacks on Langflow and n8n failed because the exposed systems did not meet the exploits' configuration requirements.","quote":"The DeepSeek-led attacks against Langflow and n8n failed because the exposed systems did not meet the exploits' configuration requirements.","source_index":1,"grade":"C"},{"step":"reached","text":"Unit 42 confirmed three successful compromises across roughly 460 attempted targets.","quote":"Across roughly 460 attempted targets, Unit 42 confirmed only three successful compromises, all involving memory data exfiltration from Citrix NetScaler and suspected session hijacking attempts against a Malaysian government entity.","source_index":2,"grade":"C"},{"step":"caught","text":"Unit 42 discovered the activity after Hermes accidentally exposed the attacker's environment through a web server.","quote":"The activity was discovered by Palo Alto Networks' Unit 42 researchers after Hermes accidentally created a web server from its home directory, exposing the attacker's environment, including API keys, exploit scripts, target lists, shell history, and AI attack logs.","source_index":0,"grade":"C"}],"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.bleepingcomputer.com/news/security/hacker-uses-deepseek-ai-to-autonomously-attack-vulnerable-servers/","https://thehackernews.com/2026/07/chinese-hacker-commands-deepseek-via.html","https://gbhackers.com/hacker-uses-deepseek-agent/"]},"analysis":{"sections":{"timeline":[{"text":"Earlier, a separate Hermes-linked incident exposed details of an alleged attack against Thailand's Ministry of Finance.","quote":"The exposed AI campaign comes after another recently disclosed incident in which poorly secured Hermes infrastructure exposed details about an alleged cyberattack against Thailand's Ministry of Finance.","source_index":0,"when":null},{"text":"In a recovered session, the agent downloaded a Langflow exploit and enumerated 84 instances.","quote":"In a recovered May 2026 session, DeepSeek downloaded a public exploit for the Langflow code-injection flaw CVE-2026-33017, enumerated 84 instances through FOFA, and found one target running version 1.3.4.","source_index":1,"when":"2026-05"},{"text":"The Langflow attack stopped because the target lacked auto_login and a usable public flow identifier.","quote":"The attack stopped because the system had neither auto_login enabled nor a usable public flow identifier.","source_index":1,"when":null},{"text":"Hermes started an unintended HTTP server from /home/worker, exposing the operation.","quote":"Hermes Agent exposed the operation by starting python3 -m http.server 8888 from /home/worker.","source_index":1,"when":null},{"text":"Palo Alto Networks' Unit 42 discovered the activity. The discovery date is not stated.","quote":"The activity was discovered by Palo Alto Networks' Unit 42 researchers after Hermes accidentally created a web server from its home directory, exposing the attacker's environment, including API keys, exploit scripts, target lists, shell history, and AI attack logs.","source_index":0,"when":null}]},"model":"claude-haiku-5-5","prompt_version":"backfill-2026-11-01.2","extracted_at":"2026-11-01","source_urls":["https://www.bleepingcomputer.com/news/security/hacker-uses-deepseek-ai-to-autonomously-attack-vulnerable-servers/","https://thehackernews.com/2026/07/chinese-hacker-commands-deepseek-via.html","https://gbhackers.com/hacker-uses-deepseek-agent/"]}}