Unit 42: Chinese speaking actor ran autonomous attacks with an AI agent

Unit 42 at Palo Alto Networks published a campaign on 30 July 2026 in which a Chinese speaking actor used an AI agent as an independent attacker. The agent found targets, fetched exploit code from public repositories and attempted exploitation without a human stepping in between the stages. The actor, whom Unit 42 links to the aliases knaithe and KnYuan, maintained active exploit tooling for seven vulnerabilities. The autonomous attempts produced no compromise, while the manual attacks produced confirmed impact. Unit 42 gained visibility because the agent itself started a file server in its home directory and exposed the entire working environment on the internet.

What happens technically

The actor used the Hermes Agent framework with DeepSeek as the reasoning model, and orchestrated it over Telegram. Hermes provided the orchestration with terminal access and a skills system, while DeepSeek made the decisions on code generation, target selection and vulnerability assessment. The setup was extended with three custom red teaming skills, among them one for bypassing the model's own restrictions and one for queries against the FOFA search service. Unit 42 also found limited use of Western tools, where Claude Code was used for connectivity and proxy testing, and where Codex left traces in the directories used for exploit development. The actor had enabled settings that reduce traceability, and routed the Western tools through a third party proxy service.

The autonomous chain is worth reading closely, because it shows both the capability and its limit. The agent started with a Langflow vulnerability scored 9.8, downloaded a public exploit from GitHub, enumerated 84 instances through FOFA and ran its scanner against them. The attempts failed because the vulnerability requires either automatic login or a public flow identifier, and the target had neither. The agent then assessed the whole product as low value, surveyed ten product families by deployment count, and searched GitHub for exploit code for recent vulnerabilities sorted by popularity. It settled on n8n, where FOFA reported 647,017 instances globally and 25,209 in China, and where two vulnerabilities scored 10.0 and 9.9 can be chained into code execution. The agent found three instances running vulnerable versions, but every form required authentication, and the attack stopped there. In total more than 460 targets were attempted, and Unit 42 could confirm three successful exploitations. All three came from the manual part of the campaign, through a Citrix NetScaler vulnerability scored 9.8, where memory was exfiltrated and searched for authentication cookies. A government entity in Malaysia was targeted repeatedly over several days. The remaining manual attempts were aimed at Marimo notebooks, Apache Tomcat and IKE based VPN endpoints.

Hunt.io described a similar setup in a separate case on 14 July 2026. There an infrastructure pivot led to an open directory on a server in Hong Kong, holding victim source code, exploit scripts and operator logs, and where Claude Code and DeepSeek-v4-pro were working parts of the intrusion. Hunt.io reports active exploitation of government systems in Afghanistan, Thailand and Taiwan, reconnaissance and prepared phishing against United States portals, and scanning of more than 5,890 government hosts across ten countries. The Unit 42 report does not refer to that case, so the two findings should be read as two independent descriptions of the same working method, not as the same operation.

What this means for you if you run internet facing systems

The most important part of the material is not that an AI attacked someone. It is what stopped the attack. Authentication in front of the forms in n8n was enough to break the autonomous chain, and a missing public identifier did the same for Langflow. We read this as confirmation of an old priority, now with new force. That priority points straight at you. It is your exposed surfaces without a login that decide the outcome, not how advanced the attacker is. At the same time the cost of searching is falling towards zero. Unit 42 describes the agent narrowing its target selection in minutes, work that would otherwise take an operator hours. The time between a vulnerability becoming public and someone trying it against your systems therefore grows shorter, regardless of how interesting your organisation is.

The second lesson is where the confirmed losses came from. They came through edge equipment, specifically a Citrix NetScaler vulnerability that let the attacker read memory and search it for authentication cookies. This is the familiar pattern, and it is still what produces impact. If your organisation falls under NIS2, both vulnerability handling and the mapping of your own exposure belong under Article 21. We would add one thing for you to carry forward. A memory exfiltration from an edge device is not over when the device has been patched. The sessions that were active in the exfiltrated data must be treated as compromised, and you have to terminate them.

Berigo recommends

• Prioritise edge equipment and internet facing services in vulnerability handling. All three confirmed compromises went through a Citrix NetScaler vulnerability.
• Require authentication in front of every form and interface reachable from the internet. Authentication is what stopped the autonomous attempts against n8n.
• Map your own exposure the way an attacker sees it, using the same internet asset search services the actor used.
• Terminate active sessions and rotate cookies and tokens after an incident on edge equipment, since the actor searched exfiltrated memory for exactly that information.
• Put patching of exposed systems on a fixed rhythm, and assume that the time from a published vulnerability to mass scanning is now measured in days.