A Chinese-speaking threat actor, identified by Unit 42 as the Zhuhai-based group knaithe/KnYuan, recently executed an autonomous hacking campaign that marks a shift in offensive cyber operations. By deploying the open-source Hermes Agent framework, the actor moved beyond human-led exploitation to a model where the AI handles target enumeration, vulnerability research, and attack execution without intervention. The operation was inadvertently exposed when the autonomous agent started a Python HTTP file server in the actor’s home directory, leaking API keys, exploit scripts, and session logs.
This incident represents the first documented operational weaponization of AI for autonomous attacks. While previous reports have focused on lab-based scenarios like OpenAI’s ExploitGym or evaluation-context incidents like the Anthropic Eval Breach, this campaign was active in the wild. The actor targeted seven specific CVEs, including critical vulnerabilities in Langflow, n8n, and Citrix NetScaler, attempting to compromise over 460 targets. While many autonomous attempts failed due to specific configuration requirements, the margin of failure was narrow; systems with weaker default settings were susceptible to the automated logic.
The core of this campaign was the selection of the reasoning engine. The actor tested multiple tools, including Claude Code and various Chinese-market models like Qwen and GLM. However, they specifically selected DeepSeek as the primary autonomous attack engine. The reason is clear: Western provider-side safety controls on platforms like Claude and OpenAI effectively blocked the actor’s attempts to perform offensive tasks. DeepSeek, accessed directly via its API, lacked these restrictive safety layers. Consequently, model safety posture has become an offensive capability selector. Threat actors are now choosing their AI infrastructure based on the absence of guardrails, effectively weaponizing the lack of safety as a feature.
The autonomous attack cycle observed by Unit 42 demonstrates the efficiency of this approach. The agent utilized the FofaMap-Platinum-Full-Expert MCP server to perform target enumeration via FOFA, searched GitHub for trending proof-of-concept exploits, and evaluated them based on severity and exploitability. In one instance, DeepSeek sampled approximately 100 of 25,209 Chinese n8n instances, probed 40, and identified three vulnerable targets in minutes — a task that would have required hundreds of hours of manual analysis. As Andy Piazza, Senior Director of Threat Intelligence at Unit 42, noted: “AI-augmented offensive capabilities enabled them to dramatically increase the speed and scale of their campaigns.”
Despite the sophistication of the autonomous cycle, the actor’s reliance on AI also provided a defensive opening. OpenAI confirmed that their provider-side safeguards successfully refused requests that violated their policies. Their safety systems flagged and disabled the account linked to the campaign before Unit 42 shared any intelligence. This highlights that while model safety is a hurdle for attackers, it remains a critical defensive layer. The irony remains that the actor’s own autonomous agent, configured to operate in “YOLO mode” for unattended execution, ultimately leaked the operational details that allowed researchers to map the entire campaign.
The actor is actively iterating, refining tool configurations, and establishing proxy infrastructure to bypass detection. The technical barrier to entry for AI-augmented offensive operations is low and continues to decrease. This campaign is part of a broader, rapid escalation: in the span of a single week, the industry has seen a progression from lab-based model escapes in ExploitGym, to evaluation-based breaches in the Anthropic incident, and now to real-world operational weaponization.
Threat actors are integrating natural-language-to-query translators and automated vulnerability intelligence pipelines to outsource the most labor-intensive parts of the kill chain to LLMs. As long as there is a disparity in safety postures between different AI providers, threat actors will continue to gravitate toward the models that offer the least resistance. The security community must now contend with a landscape where the speed of an attack is limited only by the compute resources available to the agent, rather than the human capacity to research and execute.