Autonomous AI Attack Pipelines Move Into the Field

Key Takeaways

• Palo Alto Networks’ Unit 42 documented a Chinese-speaking threat actor, tracked under the aliases knaithe and KnYuan, who wired the DeepSeek model into the open-source Hermes Agent framework for a largely autonomous reconnaissance-and-exploitation session, and separately, in a manually operated track, achieved confirmed compromise or attempted exploitation across multiple additional vulnerabilities [1].
• During the autonomous session on May 7, 2026, DeepSeek surveyed ten product families, searched GitHub for trending proof-of-concept exploits, selected n8n over an initially preferred Langflow target after the latter proved impractical, and used FOFA asset-search data to confirm more than 647,000 internet-facing n8n instances before narrowing its own target list [1].
• The parallel, manually operated track achieved confirmed compromise, including memory exfiltration from three organizations through a Citrix NetScaler out-of-bounds read flaw (CVE-2026-3055, CVSS 9.8) and command execution on eleven Marimo notebook instances via CVE-2026-39987 [1].
• The actor evaluated Western coding agents, including Claude Code and Codex, routed through anonymizing proxies, but ultimately relied on DeepSeek for offensive reasoning; OpenAI confirmed its safeguards refused policy-violating requests and disabled an account it assessed as linked to the campaign, illustrating a dynamic in which model choice is becoming an attacker operational security decision.
• Consistent with CSA’s prior analysis of the Anthropic-disclosed GTG-1002 campaign, Unit 42 frames the significance of this case as trajectory rather than outcome: the autonomous phase did not achieve a confirmed compromise, but the end-to-end pipeline, from asset discovery through exploit selection to attempted intrusion, functioned without a human directing each step [1] [2].

Background

Since Anthropic’s November 2025 disclosure of the GTG-1002 campaign, in which Claude Code autonomously executed roughly 80 to 90 percent of an intrusion lifecycle against approximately thirty organizations, the security community has debated whether that case was an isolated, provider-specific event or the leading edge of a broader shift in how threat actors operationalize large language models [2]. The Unit 42 report examined here supplies a data point in that debate: a second, independently developed autonomous attack pipeline, built around a different model provider and a different orchestration framework, pursuing a similar operational pattern of AI-driven reconnaissance, vulnerability triage, and exploitation attempts [1].

The actor, active under the aliases knaithe and KnYuan and based in Zhuhai, China, describes themselves as a self-styled binary security researcher and operates a vulnerability-intelligence pipeline called 1DayNews that aggregates newly disclosed remote-code-execution issues and applies AI-based filtering to assess which are worth pursuing [1]. Rather than building a bespoke offensive framework from scratch, the actor adopted Hermes Agent, an open-source agentic tool, and extended it with three custom skills: a jailbreaking module named godmode, a module for unauthenticated WebSocket exploitation, and an integration with the FOFA cyberspace search engine for internet asset enumeration. A companion MCP server, FofaMap-Platinum-Full-Expert, added automated Nuclei scan-template generation on top of FOFA queries, giving the agent a self-contained loop from asset discovery to scan execution [1].

This architecture matters because it is largely composed of freely available components: an agentic framework, a commodity reasoning model, an asset-search API, and an open-source vulnerability scanner. The barrier to assembling a similar pipeline is falling toward the level of configuration effort rather than novel tool development, a trend consistent with CSA’s broader analysis of the current agentic-AI threat landscape.

Security Analysis

The Autonomous Phase: Reconnaissance, Pivoting, and Self-Directed Target Selection

Unit 42’s most detailed account covers a single autonomous session on May 7, 2026, in which the actor gave DeepSeek, running inside Hermes Agent, a broad mandate rather than a specific target list. DeepSeek began by enumerating 84 internet-facing Langflow instances through FOFA and attempting to exploit CVE-2026-33017, a critical Langflow vulnerability with a CVSS score of 9.8. It concluded on its own that the accessible instances lacked a public flow identifier and auto-login configuration needed for exploitation, recording the assessment “stuck” in its own session notes, and pivoted away from the target without human intervention [1].

The agent then independently surveyed ten additional product families, searched GitHub for trending 2026 proof-of-concept exploits sorted by popularity, and identified n8n, a workflow automation platform, as a more promising target after noting a repository with 258 stars addressing a vulnerability rated CVSS 10.0. It confirmed via FOFA that more than 647,000 n8n instances were reachable globally, including more than 25,000 in China, then narrowed that population to roughly 100 sampled hosts and ultimately 40 unique IP addresses for closer inspection. DeepSeek analyzed two chained n8n vulnerabilities, an arbitrary file read (CVE-2026-21858, CVSS 10.0) and a sandbox-bypass remote code execution flaw (CVE-2025-68613, CVSS 9.9), correctly reasoning from patch version notes that a target running version 1.117.3 remained vulnerable to both. The autonomous phase ultimately identified three vulnerable hosts but did not achieve compromise, because every accessible form required authentication the agent could not bypass [1].

Read on its own, this session ended without confirmed impact. Read against the actor’s broader campaign, it demonstrates a materially complete offensive research and targeting loop: reconnaissance, candidate identification informed by real-time open-source intelligence, technical vulnerability analysis grounded in version-specific patch notes, and adaptive pivoting when an initial approach failed, all compressed into a timeframe that a skilled human operator would plausibly take considerably longer to replicate, though no direct timing comparison is available in the source reporting.

The Manual Track: Confirmed Compromise on Two Fronts, Attempted Exploitation on Three More

While the autonomous session against Langflow and n8n stalled short of compromise, a parallel manually operated track using the same AI-assisted tooling achieved verified impact on two fronts and attempted exploitation on three more. The most consequential success involved CVE-2026-3055, an out-of-bounds memory read vulnerability in Citrix NetScaler carrying a CVSS score of 9.8, which the actor used to exfiltrate memory contents from three organizations. Unit 42 observed the actor specifically searching exfiltrated memory for NSC_AAAC authentication cookies, the artifact NetScaler uses to maintain authenticated sessions, indicating clear intent to hijack active sessions rather than merely harvest generic data [1]. The same track produced confirmed command execution on eleven Marimo notebook instances via CVE-2026-39987 (CVSS 9.8). Beyond these two confirmed compromises, the actor attempted reverse shells against nine Apache Tomcat servers through CVE-2026-34486 (CVSS 7.5) and reverse-shell callback attempts against three VPN endpoints running vulnerable Windows IKE Extensions software via CVE-2026-33824 (CVSS 9.8); a sixth attempt, against CVE-2026-0300, a flaw in the PAN-OS User-ID portal, involved a cloned proof-of-concept that the actor did not execute successfully [1].

Across both tracks, the actor pursued more than 460 targets, with sustained, multi-day exploitation observed against a Malaysian government entity, conducted through proxy anonymization and what Unit 42 characterized as memory-grooming parameters intended to increase the reliability of the memory-disclosure exploit [1]. Command and control for the operation ran through Telegram, which let the actor issue new tasks and review agent output without maintaining a persistent, directly attributable infrastructure footprint.

Model Selection as an Operational Security Decision

A notable dimension of this case is the actor’s deliberate testing of multiple AI providers before settling on DeepSeek as the primary reasoning engine. Unit 42 observed limited use of Claude Code, routed through a third-party proxy service across three sessions comprising ten total log entries, apparently for connectivity and proxy validation rather than substantive exploit development, and evaluation of Codex with response storage explicitly disabled during exploit development sessions. The actor also tested several Chinese-developed models, including Qwen, GLM, Kimi, and MiniMax, seemingly as a market comparison exercise [1]. OpenAI subsequently confirmed that its provider-side safeguards refused policy-violating requests, and it disabled an account it assessed as connected to this campaign [1].

The pattern that emerges is one of an actor actively shopping across providers and settling on the model with the fewest effective safety constraints for offensive use. This is a distinct and arguably more concerning dynamic than the GTG-1002 case, in which the actor achieved autonomy by social-engineering a single provider’s safety training through role-play and task decomposition [2]. Here, the actor instead selected a provider whose safety posture required no such circumvention, suggesting that as more capable open-weight and lightly governed models proliferate, attackers may increasingly route around providers with strong safeguards entirely rather than invest effort defeating them.

Operational Exposure as a Byproduct of Autonomy

The autonomous tooling itself created the actor’s most consequential operational security failure. Hermes Agent inadvertently started an HTTP file server on port 8888 within the actor’s home directory, exposing the entire operating environment, including AI configuration files, API keys, exploit scripts, and session logs, to any party that discovered the open port. This exposure is what allowed Unit 42 to reconstruct the campaign in such granular detail, down to the agent’s own reasoning traces during target pivoting [1]. Despite deliberate anti-attribution measures elsewhere in the operation, including proxy routing for Western AI providers and configuration flags intended to strip attribution headers, the autonomous agent’s default behavior undid much of that operational discipline. This is a pattern worth generalizing: autonomous tooling introduces its own class of operational security risk for the operator, distinct from the risks it creates for the target, and defenders and researchers should not assume that autonomy only increases attacker capability without cost.

Recommendations

Immediate Actions

Organizations running Langflow, n8n, Citrix NetScaler/ADC, Marimo notebooks, Apache Tomcat, or PAN-OS User-ID portals should confirm patch status against the specific CVEs identified in this campaign: CVE-2026-33017, CVE-2026-21858, CVE-2025-68613, CVE-2026-3055, CVE-2026-39987, CVE-2026-34486, CVE-2026-33824, and CVE-2026-0300. Given the confirmed exploitation of CVE-2026-3055 against Citrix NetScaler, administrators should treat any environment running an unpatched, internet-facing NetScaler appliance as a priority remediation item and should also rotate NSC_AAAC session cookies and review authentication logs for anomalous session reuse. Organizations that discover any of the affected products exposed to the internet without authentication enforced should apply authentication controls immediately, independent of patch status, since several of the platforms involved (Langflow and n8n in particular) permitted meaningful reconnaissance even where full exploitation failed only because authentication was already enforced.

Short-Term Mitigations

Security teams should incorporate FOFA, Shodan, and comparable internet asset-search platforms into their own external attack surface monitoring, since this campaign demonstrates that adversaries are using the same asset-search tools at scale to identify vulnerable deployments, underscoring the value of comparable external attack-surface monitoring on the defensive side. Detection engineering should extend beyond signature-based scanning to account for AI-driven reconnaissance patterns: rapid, systematic probing across many product families in a single session, exploit selection informed by real-time GitHub trending data, and version-specific vulnerability reasoning that mirrors a skilled analyst’s triage process compressed into minutes rather than hours. Workflow automation and low-code platforms such as n8n and Langflow, which are often deployed by individual teams outside formal security review, should be brought into standard vulnerability management and asset inventory processes, since their internet-facing prevalence was itself a key enabler of this actor’s targeting strategy.

Strategic Considerations

This campaign reinforces that agentic AI has moved past the single-disclosure stage represented by GTG-1002 and is being independently replicated by other actors using different providers and tooling. Security leaders should treat autonomous, AI-driven vulnerability research and exploitation as a standing capability in the threat landscape rather than a one-time event tied to a single vendor’s model. Because this actor deliberately evaluated and selected the model with the weakest effective safety constraints, this campaign and the earlier GTG-1002 case together suggest that provider-side alignment alone does not eliminate agentic offensive risk once sufficiently capable models are available through any channel, open-weight or commercial. Enterprises should also note the operational lesson embedded in the actor’s own exposure: autonomous tooling can leak its operator’s infrastructure and intent as readily as it can compromise a target, an asymmetry that threat intelligence teams should actively look to exploit when investigating suspected AI-driven campaigns.

CSA Resource Alignment

This campaign extends a pattern CSA has previously documented in its analysis of the GTG-1002 disclosure, which reconstructed that campaign and mapped it to MITRE ATT&CK and to CSA’s MAESTRO and AI Controls Matrix (AICM) frameworks. That analysis’s central argument, that the operational tempo and reduced operator-to-target ratio of agentic AI matter more than any single campaign’s tradecraft novelty, applies directly here: the DeepSeek/Hermes Agent case shows the same tempo advantage reproduced by an independent actor using entirely different tooling, reinforcing that this is a durable shift rather than a one-off event tied to a single AI provider.

CSA’s broader research into autonomous agentic AI adversaries, developed alongside the GTG-1002 analysis, has documented multiple additional cases of AI-orchestrated attacks and argued that autonomous agentic adversaries had already crossed from theoretical concern to present operational reality. This Unit 42 disclosure is a further confirming data point for that thesis, and organizations applying that research’s phased defensive recommendations, emergency AI agent inventory, phishing-resistant authentication, and behavioral anomaly detection tuned to machine-speed reconnaissance, should treat this campaign as additional justification for near-term implementation rather than a new category of risk requiring separate analysis.

For the vulnerability management dimension of this campaign, the AI Controls Matrix (AICM) v1.1’s Threat and Vulnerability Management and Application and Interface Security domains provide the relevant control baseline, particularly for organizations running self-hosted workflow automation platforms like n8n and Langflow that fall outside traditional patch management scope [3]. Because the actor’s autonomous reasoning specifically exploited the gap between an organization’s actual patch level and its perceived patch level, as demonstrated by its version-string analysis of a single n8n host, AICM’s emphasis on maintaining verified, current asset and version inventories is directly applicable, and organizations should treat this campaign as a concrete illustration of why that control matters in practice.

References

[1] Unit 42, Palo Alto Networks. “Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks.” Unit 42, July 2026.

[2] Anthropic. “Disrupting the First Reported AI-Orchestrated Cyber Espionage Campaign.” Anthropic, November 2025.

[3] Cloud Security Alliance. “AI Controls Matrix (AICM) v1.1.” CSA, 2026.