DeepSeek Ran 460 Attacks Autonomously. Claude Said No.

On July 30, 2026, Palo Alto Networks' Unit 42 published what appears to be the first documented, in-the-wild autonomous attack loop: a threat actor gave one Telegram command, stepped back, and let a DeepSeek-powered agent handle recon, CVE research, exploit acquisition, and execution without further human input. The actor tested Claude Code and OpenAI Codex first. Both were relegated to peripheral tasks. That ordering is the detail worth examining.

What Actually Happened#

The actor, tracked under the aliases knaithe and KnYuan and assessed by Unit 42 to be based in Zhuhai, China, wired DeepSeek into the open-source Hermes Agent framework. Hermes provided orchestration: terminal access, Telegram-based command and control, and a custom skills system. DeepSeek served as the reasoning engine for target selection, vulnerability assessment, and code generation.

The operation was exposed inadvertently. Hermes, responding to a command, started a Python HTTP file server (python3 -m http.server 8888) from the actor's home directory rather than an isolated staging path. That mistake gave Unit 42 access to API keys, exploit scripts, target lists, shell history, and full session logs.

From a May 7, 2026 session Unit 42 recovered, the autonomous sequence ran as follows: DeepSeek enumerated 84 Langflow instances via FOFA, assessed CVE-2026-33017 (CVSS 9.8), determined exploitation required auto_login enabled and found none, then independently pivoted. It surveyed 10 product families, searched GitHub for trending 2026 CVE PoC repositories sorted by stars, and selected n8n, which had 647,017 exposed instances globally. The agent downloaded a chained exploit for CVE-2026-21858 (CVSS 10.0) and CVE-2025-68613 (CVSS 9.9), probed version endpoints on roughly 40 unique Chinese IP addresses, found three running vulnerable versions, and then hit authentication walls on every form endpoint it needed. Both autonomous campaigns failed. The target-side configuration stopped them, not the model.

The Claude and Codex Finding#

The actor configured four AI coding tools. Claude Code's session history contained 10 entries across three sessions: /model checks, connectivity tests, and one npm install request. Nothing else. Codex was configured with disable_response_storage = true, and no chat logs were recovered. Unit 42 notes that OpenAI confirmed their provider-side safeguards refused policy-violating requests from an account believed linked to this campaign, and that continued attempts caused their safety systems to flag and disable it before Unit 42 even shared intelligence with them.

The actor routed both Western tools through a third-party proxy at code.newcli[.]com to reduce traceability. DeepSeek was accessed directly through its native API. The configuration table in the Unit 42 report is explicit: Hermes ran with no built-in safety layer and a custom godmode jailbreaking skill. Claude Code ran with dangerously-skip-permissions: true and 12 tools explicitly allowlisted , and still did not execute offensive tasks. The provider-side controls held where the client-side configuration had been deliberately stripped.

This is the first confirmed case where the choice of model for an autonomous attack engine was determined by which providers' controls got in the way.

Where the Damage Actually Came From#

The autonomous AI campaigns failed. Every confirmed impact came from manual operations.

Three organizations had data exfiltrated through CVE-2026-3055, the Citrix NetScaler out-of-bounds memory read flaw. The actor searched that exfiltrated memory for NSC_AAAC= authentication cookies, indicating session hijacking intent. A government entity in Malaysia was targeted persistently over multiple days, with refined memory grooming parameters and proxy anonymization on return visits. Eleven Marimo notebook instances had command execution confirmed via CVE-2026-39987. Nine Apache Tomcat servers received Java deserialization reverse shell attempts via CVE-2026-34486. Three Windows IKE VPN endpoints were targeted via CVE-2026-33824.

All seven CVEs were known, publicly disclosed vulnerabilities with available patches. The AI did not discover novel attack surface. It compressed the time from target enumeration to exploit attempt from hours to minutes, and it managed its own compute allocation by sampling approximately 100 addresses out of 25,209 FOFA-identified n8n instances rather than scanning exhaustively.

What This Means for Teams Running Coding Agents#

The buried implication in the Unit 42 report is about infrastructure, not just the specific actor. The actor built a persistent offensive environment: custom automation skills, MCP server integration, proxy anonymization, and Telegram command and control, designed to retain and reuse successful procedures across sessions. The substrate for that environment, DeepSeek-Coder running through an open-source agentic framework with no review layer, is not exotic. Variants of that configuration exist in development sandboxes and CI pipelines at many organizations today.

The distinction between a coding agent and an attack tool in this case came down to one thing: what the agent was allowed to write, what it was allowed to execute, and what it could reach on the network. Hermes had terminal access, internet access, and a FOFA integration. No approval step stood between its reasoning and execution. The actor explicitly marked exploit development directories as trusted to grant full read, modify, and execute permissions.

Teams evaluating open-weight models for coding assistance should treat the review layer as a security control, not a convenience feature. The specific shape of risk is: an agent that can write to disk, execute commands, and make outbound network requests, operating without a verification step on its output, in an environment that has credentials or network access worth protecting. That description fits more development environments than most security reviews account for.

Hyrax reviews the artifacts coding agents produce, covering the six domains where problems accumulate: security, code quality, reliability, API and data handling, ops, and UX. The 13-step verification process runs before anything becomes a pull request. The specific failure mode this campaign documents, an agent writing and executing code in a trusted directory without a review gate, is precisely the gap that review layer addresses.

For a closer look at how that verification step is structured, the post the verification gate walks through the 13-step process between a candidate change and a submitted PR.

What to Configure Now#

Based on the Unit 42 findings, the practical controls are specific.

Patch CVE-2026-3055 on any Citrix NetScaler ADC or Gateway deployment. It is under active exploitation with confirmed exfiltration. Patch CVE-2026-39987 on Marimo notebook instances if any are internet-facing. Review n8n deployments: CVE-2026-21858 is patched in version 1.121.0 and CVE-2025-68613 in 1.120.4. Versions below 1.117.3 are vulnerable to both in a chained sequence.

For the broader agent question: audit what network access, file system permissions, and execution capabilities any coding agent in your environment holds. If an agent can reach FOFA, GitHub, or arbitrary external endpoints from a development environment that also holds credentials or internal network access, the trust boundary is not where you think it is. The actor's operational security failure, Hermes starting a file server in the home directory, is a useful reminder that autonomous agents make autonomous decisions about their environment. The forensic artifacts that exposed this operation would not have existed under manual execution. That cuts both ways.

Hyrax is live at hyrax.dev.