Cases › security breach › LR-2026-0610
Hacker uses DeepSeek agent to autonomously attack vulnerable servers
Confirmed Why: 3 independent outlets · 3 independent reports
Status: advice only, no fix reported
No source states: loss or records, deployer, industry.
Severity moderate: test met: data and systems of others were touched, and the scope is bounded to three confirmed compromises
A Chinese-speaking threat actor used the DeepSeek model inside the open-source Hermes Agent framework to run offensive operations against internet-exposed systems. After an initial operator task, the agent searched for targets, downloaded public exploits and attempted attacks on Langflow and n8n. Those attempts failed because the exposed systems did not meet the exploits' requirements. The same operator conducted separate manual attacks on more than 460 systems, with three confirmed compromises. Hermes accidentally started a web server from its home directory, exposing the operator's keys, exploit scripts, target lists and logs. Palo Alto Networks' Unit 42 discovered the activity and reported it on 2026-07-31.
What happened
What was done
“Organizations should patch exposed Langflow, n8n and Marimo systems, along with customer-managed NetScaler ADC or Gateway appliances configured as Security Assertion Markup Language (SAML) identity providers.”
Risks
Primary96 incidents
Rising: 24 vs 4.0 a week
Also63 incidents
Rising: 5 vs 2.2 a week
Read from the sources; not yet reviewed by a person.
Controls
ApplicationDid not exist Human approval for high-impact actions
Control failure chain
L1 · ModelDeepSeekModel provider
No source mentions a control at this layer.
Model version not linked to a model card.
Other controls for this risk at this layer, not mentioned in the sources: Safety training and refusal, Cyber and weapons safeguards, Abuse monitoring and account enforcement, Staged or restricted release, Dangerous-capability testing before release, Outside red-teaming, Content safety classifiers, Safeguards kept on in testing, Reasoning monitoring.
L2 · HarnessHermes AgentAgent framework vendor
No source mentions a control at this layer.
L3 · ApplicationThe attackerDeployer
The attacker ran the agent; this layer was the attacker's own.
L4 · Infrastructure / targetOrganisation hit
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Known flaws patched, Multi-factor sign-in and password policy, Network segmentation, Intrusion and endpoint detection, Backups and recovery, Phishing and fraud filters.
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
Controls for this risk: result in this incident
| Control | Part of the system | Result |
|---|---|---|
| Content safety classifiers | L1 Model | Not stated in sources |
| Safety training and refusal | L1 Model | Not stated in sources |
| Cyber and weapons safeguards | L1 Model | Not stated in sources |
| Dangerous-capability testing before release | L1 Model | Not stated in sources |
| Outside red-teaming | L1 Model | Not stated in sources |
| Staged or restricted release | L1 Model | Not stated in sources |
| Abuse monitoring and account enforcement | L1 Model | Not stated in sources |
| Reasoning monitoring | L1 Model | Not stated in sources |
| Safeguards kept on in testing | L1 Model | Not stated in sources |
| Human approval for high-impact actions | L3 Application | Did not exist |
| Known flaws patched | L4 Infrastructure / target | Not stated in sources |
| Multi-factor sign-in and password policy | L4 Infrastructure / target | Not stated in sources |
| Network segmentation | L4 Infrastructure / target | Not stated in sources |
| Intrusion and endpoint detection | L4 Infrastructure / target | Not stated in sources |
| Backups and recovery | L4 Infrastructure / target | Not stated in sources |
| Phishing and fraud filters | L4 Infrastructure / target | Not stated in sources |
Similar incidents
Evidence
No source states: what the AI was doing, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.
Show the full account: 5 items from the primary sources
What happened, in order
- 2026-05 In a recovered session, the agent downloaded a Langflow exploit and enumerated 84 instances.
Not dated in the sources:
- Earlier, a separate Hermes-linked incident exposed details of an alleged attack against Thailand's Ministry of Finance.
- The Langflow attack stopped because the target lacked auto_login and a usable public flow identifier.
- Hermes started an unintended HTTP server from /home/worker, exposing the operation.
- Palo Alto Networks' Unit 42 discovered the activity.
Show every field, with its source and grade
The AI system
What happened
Impact
Notes on gaps
Discovery date is not stated; the occurrence is known only as a May 2026 session.
LR-2026-0610 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON