An autonomous agent attacked more than 460 targets in four days, without compromising any of them

Unit 42 was able to observe from inside an offensive campaign led by DeepSeek via the Hermes Agent frame: the agent had exposed his own file server.

Researchers at Unit 42, Palo Alto Networks' threat intelligence team, documented an offensive campaign in which most of the attack chain ran without human intervention. The actor, a sinophone known as "Knathe" and "KnYuan", targeted more than 460 targets in about four days in July.

The assembly combines two bricks: the Hermes Agent frame provides orchestration, while DeepSeek plays the role of reasoning agent, i.e. decision maker. The operator was piloting the whole from Telegram. The agent alone listed targets and their vulnerabilities using the FOFA search engine, went to download publicly available operating code, and then tried to use it.

Researchers owe their unusual visibility to an agent's awkwardness: he has launched a file server into his own personal directory, exposing his entire operating environment. None of the observed targets have been effectively compromised, but Unit 42 mainly retains the demonstration: an offensive chain capable of discovering, evaluating and attacking vulnerable, autonomous systems.