Cases › security breach › LR-2026-0643
Chinese-speaking threat actor uses AI models for autonomous cyberattacks
Preliminary Why: Publisher not yet named · subject to change
Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.
Status: action reported, no fix
No source states: loss or records, deployer, industry.
Severity major: Test: many third parties with a stated count of two or more affected parties and a live production compromise. Fact: data exfiltrated from three Citrix NetScaler targets and command execution on 11 Marimo notebook endpoints.
A Chinese-speaking threat actor used DeepSeek through the Hermes Agent framework as an autonomous offensive operator, orchestrated via Telegram, to enumerate targets and attempt exploits. The autonomous attempts against Langflow and n8n failed because target configurations blocked exploitation. Separately, manual operations confirmed data exfiltration from three Citrix NetScaler targets and command execution on 11 Marimo notebook endpoints. The agent started an HTTP file server from the actor's home directory, which exposed the operator's workspace to the researchers who analysed its session logs. OpenAI reported that its safety systems flagged and disabled an account it believes is linked to the campaign.
What happened
What was done
Risks
Primary96 incidents
Rising: 24 vs 4.0 a week
Read from the sources; not yet reviewed by a person.
Controls
ModelEffective Safety training and refusal
Effective Abuse monitoring and account enforcement
Control failure chain
L1 · ModelDeepSeekModel provider
Model version not linked to a model card.
Other controls for this risk at this layer, not mentioned in the sources: Cyber and weapons safeguards, Staged or restricted release, Dangerous-capability testing before release, Outside red-teaming, Content safety classifiers, Safeguards kept on in testing, Reasoning monitoring.
L2 · HarnessHermes AgentAgent framework vendor
No source mentions a control at this layer.
L3 · ApplicationThe attackerDeployer
The attacker ran the agent; this layer was the attacker's own.
L4 · Infrastructure / targetOrganisation hit
No source mentions a control at this layer.
Other controls for this risk at this layer, not mentioned in the sources: Known flaws patched, Multi-factor sign-in and password policy, Network segmentation, Intrusion and endpoint detection, Backups and recovery, Phishing and fraud filters.
EffectiveNot effectiveNot effective (bypassed)Did not existNot stated in sourcesNot yet checkedAttacker's ownOrder: model · harness · application · target
Controls for this risk: result in this incident
| Control | Part of the system | Result |
|---|---|---|
| Safety training and refusal | L1 Model | Effective |
| Abuse monitoring and account enforcement | L1 Model | Effective |
| Content safety classifiers | L1 Model | Not stated in sources |
| Cyber and weapons safeguards | L1 Model | Not stated in sources |
| Dangerous-capability testing before release | L1 Model | Not stated in sources |
| Outside red-teaming | L1 Model | Not stated in sources |
| Staged or restricted release | L1 Model | Not stated in sources |
| Reasoning monitoring | L1 Model | Not stated in sources |
| Safeguards kept on in testing | L1 Model | Not stated in sources |
| Known flaws patched | L4 Infrastructure / target | Not stated in sources |
| Multi-factor sign-in and password policy | L4 Infrastructure / target | Not stated in sources |
| Network segmentation | L4 Infrastructure / target | Not stated in sources |
| Intrusion and endpoint detection | L4 Infrastructure / target | Not stated in sources |
| Backups and recovery | L4 Infrastructure / target | Not stated in sources |
| Phishing and fraud filters | L4 Infrastructure / target | Not stated in sources |
Similar incidents
Evidence
No source states: what the AI was doing, what went wrong, what it reached or did, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.
Show the full account: 2 items from the primary sources
What happened, in order
Not dated in the sources:
- The Hermes Agent started an HTTP file server from the actor's home directory, exposing the workspace.
- OpenAI's safety systems flagged and disabled an account linked to the campaign, before intelligence was shared with Unit 42.
Show every field, with its source and grade
The AI system
What happened
Impact
Notes on gaps
The OpenAI account action is a provider action, recorded as a fix; the remediation text is the provider's safeguards and account disabling.
LR-2026-0643 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON