Autonomous AI Attacker Hit 460 Targets, Breached Three

An Autonomous Attacker Ran DeepSeek Against 460 Targets and Broke Into Three

Unit 42 traced a Chinese-speaking operator running intrusions through a Telegram-orchestrated agent built on open Chinese model weights. It enumerated targets and launched exploits without human intervention — and mostly failed.

Jul 30, 2026Source: Unit 42

Palo Alto Networks' Unit 42 published research on 30 July documenting a Chinese-speaking threat actor — using the aliases knaithe and KnYuan, based in Zhuhai — who wired a large language model into an offensive pipeline and let it run.

The stack

The operator built on DeepSeek through the Hermes Agent framework and drove it over Telegram. Unit 42 observed the agent independently enumerating targets and their vulnerabilities using FOFA, sourcing exploit tooling, and initiating attacks without human intervention. The actor also tested Qwen, GLM, Kimi and MiniMax, plus limited use of Claude Code and Codex.

What it went after

Seven CVEs were exploited or staged, across Langflow, n8n, Citrix NetScaler, Apache Tomcat, Marimo Notebook, PAN-OS and Windows IKE. Two of those — Langflow and n8n — are themselves AI and automation tooling, which is the quiet subplot: the agent was hunting the infrastructure other people's agents run on.

The reconnaissance was the strong part

Autonomous research surveyed ten product families. The agent enumerated 84 exposed Langflow instances and identified 647,017 n8n instances globally, 25,209 of them in China. That is scanning at a scale and speed no individual operator reaches by hand.

The execution was not

Of more than 460 targets attempted, Unit 42 confirms three successful exploitations. Automation delivered breadth; it did not deliver reliability, and the exploitation phase still leaned on manual work. The honest reading is a capability that has industrialised the cheap half of intrusion while the expensive half stayed hard.

Why It Matters

The debate over AI-enabled attackers has run on speculation and vendor demos. This is a documented campaign with a hit rate — three in 460 — which is both less alarming and more useful than either side of that argument assumed. Reconnaissance is now essentially free; exploitation is not.