A hacker set up an AI agent to search for vulnerable systems and launch attacks with minimal supervision. The agent worked quickly, changed targets when its first approach failed and carried out much of the process without further instructions.
But it also made a mistake that exposed the hacker’s API keys, exploit scripts, target lists and attack logs.
How the attack worked
According to Unit 42, the Chinese-speaking threat actor used DeepSeek through an open-source framework called Hermes Agent. The framework gave the model access to a terminal, reconnaissance tools and Telegram-based commands.
The attacker had also added custom skills for finding internet-facing systems and generating vulnerability scans. DeepSeek could run the tools, review the results and decide what to try next.
The DeepSeek agent first searched for servers running Langflow, a platform used to build AI applications. It identified 84 accessible instances, downloaded public exploit code from GitHub and found a system running a vulnerable version. The attack failed, because the system did not have the settings required for the exploit to work.
Why the AI changed targets
After the Langflow attempt failed, the agent did not choose to stop. It compared the online footprint of 10 other software products, searched GitHub for recent exploit code and assessed which vulnerability offered the best opportunity.
It selected n8n, a widely used workflow automation platform. DeepSeek sampled potential targets, checked their software versions and found three that appeared vulnerable. Those attacks also failed because the forms needed for exploitation were protected by authentication.
Unit 42 found no additional instructions from the operator after the initial task in the recovered session. The hacker had assembled the tools and chosen the objective, but the agent handled the target research, vulnerability assessment and change in direction.
How the AI exposed the operation
Later, Hermes Agent received a Telegram command to start a basic web server. It ran the server from the attacker’s home directory rather than a separate folder containing only the files intended for sharing.
That opened the attacker’s wider workspace to Unit 42 researchers. It contained AI configurations, API keys, exploit code, target information, command history and logs documenting the autonomous activity.
The agent completed the command, but it did so from the wrong location and exposed far more than its operator intended.
What stopped the attacks
A single hacker is now able to hand much of the attack process over to AI, from finding targets and testing vulnerabilities to choosing what to try next. That leaves organisations with much less time to find and fix exposed systems before an automated attacker reaches them.
Basic cybersecurity controls still stopped the attacks. Authentication and safer configuration were enough. But give an AI agent broad access, and a small error can expose much more than intended.
