AI agent chose targets and switched vulnerability on its own in Chinese campaign

Unit 42 published an account on 30 July 2026 of a Chinese speaking actor who used the DeepSeek language model together with the Hermes Agent framework to run attack campaigns without human steering along the way. The setup searched out targets, pulled ready made exploit code from GitHub and attempted to exploit vulnerabilities in products such as Langflow, n8n, Citrix NetScaler and Apache Tomcat. The autonomous attempts produced no confirmed compromise, while manual exploitation within the same operation extracted data from a target in Malaysia. The operation was exposed by the automation itself, when the agent started an open file server in its own home directory.

What happens technically

The setup consists of two parts doing different jobs. DeepSeek is the reasoning element that judges and chooses, while Hermes Agent is the framework that gives the model hands, meaning terminal access, a control channel over Telegram and a system of reusable skills. Unit 42 describes how the agent first went after Langflow and the vulnerability CVE-2026-33017. NVD records that this vulnerability carries a CVSS score of 9.8, and that it gives code execution without login through a public build endpoint in Langflow. The attempt stalled because the targets lacked the preconditions the exploit requires, and the agent then judged the product to be of low value.

The interesting part happens in the next step. Rather than stopping, the agent searched out alternative targets, worked through several product families and looked on GitHub for recent exploit code sorted by popularity. The choice fell on the workflow tool n8n, where a publicly available exploit chains two vulnerabilities together, and the agent compared version ranges to find vulnerable builds. This attempt also stalled, this time because the endpoints required login. The manual part of the operation was more accurate, and went among other things after CVE-2026-3055 in Citrix NetScaler. NVD records that this vulnerability carries a score of 9.8 and appears in the CISA catalogue of vulnerabilities known to be exploited. Operational security finally failed at home, when the agent started a simple file server in the home directory and made keys, scripts, target lists and logs reachable from outside. Hunt Intelligence has described an operation with the same hallmarks, in which operators based in China combined commercial coding agents with DeepSeek, and in which an exposed directory likewise revealed the activity. The two reports overlap in method and infrastructure.

What this means for you if you run internet facing services

To our mind the key finding is not that AI managed to break in. It did not. The key finding is that the cost of trying is approaching zero. An agent that finds targets, pulls code and switches vulnerability whenever something fails can keep going for hours without a human watching. The attack surface you expose to the internet is therefore the same as before, but it is visited far more often.

What stopped the autonomous attempts is worth noting. Ordinary controls stopped them. The exploits assumed features that were turned off, or endpoints that demanded a login. The attacks were stopped by configuration, not by detection. Where NIS2 applies to your organisation, this is Article 21 in practice, meaning control over exposed services, prompt remediation of known vulnerabilities and logging that makes it possible to see what arrived. We would add that your exposed development and automation tooling deserves a round of its own. Tools such as Langflow and n8n are often stood up by a team outside the operations organisation, and they rarely reach your formal asset inventory.

Berigo recommends

• Map internet facing automation and development tooling, and remove whatever does not need to be reachable.
• Require authentication on every endpoint in such tooling, including the ones that look like harmless forms.
• Prioritise remediation of vulnerabilities listed in the CISA catalogue of known exploited vulnerabilities.
• Look for the pattern in the logs, meaning many different exploit attempts from the same source in rapid succession.
• Include agent driven attacks in exercises and in the risk assessment, and practise detecting broad scanning followed by targeted attempts.