A Chinese-speaking threat actor has weaponized open-weight AI models to conduct fully autonomous cyberattacks, marking a significant shift in how artificial intelligence is being used for offensive operations. Security researchers at Palo Alto Networks' Unit 42 identified the campaign in July 2026, revealing that the attacker used DeepSeek as the primary reasoning engine within the Hermes Agent framework to independently enumerate targets, identify vulnerabilities, and launch exploits with minimal human oversight.

How Are Attackers Using Chinese AI Models for Hacking?

The threat actor, operating under the aliases knaithe and KnYuan, configured multiple large language models (LLMs), which are AI systems trained to understand and generate human language, to work together in an attack workflow. The primary tool was DeepSeek, an open-weight Chinese AI model, paired with the Hermes Agent framework, which provided orchestration capabilities including terminal access and command-and-control via Telegram.

Beyond DeepSeek, the attacker tested and configured several other Chinese AI models in a limited capacity, suggesting they were evaluating the broader AI market for their offensive needs. These included Qwen, GLM, Kimi, and MiniMax. The actor also experimented with Western platforms like Claude Code and Codex, but primarily for connectivity testing and proxy validation rather than core attack operations.

The attacker customized the Hermes Agent framework with three specialized red-teaming skills designed to automate the hacking process. These included a "godmode" jailbreaking skill, a custom web-terminal exploitation procedure, and a specialized skill that instructed DeepSeek to use the attacker's own scripts to search for vulnerable internet-connected assets using FOFA, a popular internet asset search engine.

What Makes This Autonomous Attack Campaign Different?

The campaign demonstrates a functional end-to-end autonomous offensive capability that required minimal human intervention once the initial task was assigned. Researchers recovered a detailed sequence from a single Hermes Agent session on May 7, 2026, showing how DeepSeek independently executed multiple attack phases without waiting for operator commands.

In one documented example, DeepSeek identified a Langflow vulnerability with a severity score of 9.8 out of 10 and autonomously executed the following steps without human direction:

• Downloaded Exploit Code: The AI agent retrieved a public proof-of-concept exploit from GitHub without manual intervention.
• Enumerated Targets: DeepSeek used FOFA to identify 84 instances of Langflow running on the internet.
• Executed Scanner: The agent ran the exploit scanner against the target list with 10 parallel threads to speed up the process.
• Assessed Results: When exploitation failed due to target configuration restrictions, DeepSeek independently evaluated the vulnerability as low-value and decided to pivot to higher-priority targets.

When the initial exploitation strategy failed, DeepSeek conducted autonomous research to identify more promising vulnerabilities. The AI agent surveyed deployment counts across 10 different product families, searched GitHub for trending 2026 vulnerability proofs-of-concept sorted by popularity, and evaluated each candidate based on severity, deployment footprint, and exploitability before selecting n8n as a higher-value target.

How Did Researchers Discover This Campaign?

The threat actor's operational security failed when the autonomous agent inadvertently exposed its infrastructure by starting a file server in its home directory. This accidental exposure gave Palo Alto Networks researchers unprecedented visibility into the attacker's full tool set, configuration files, and session logs, allowing them to understand exactly how the AI models were being orchestrated and what targeting decisions the autonomous agent had made.

The exposed infrastructure revealed that the actor had configured both Western and Chinese AI tools with anti-attribution settings to reduce traceability. Claude Code was configured with specific headers to disable attribution tracking, while Codex was set to disable response storage to prevent chat logs from being preserved. DeepSeek and Qwen were accessed directly through their native API endpoints without proxy routing, suggesting the attacker had less concern about attribution for Chinese-origin tools.

What Are the Security Implications?

While the observed campaign achieved limited impact, the workflow confirms that attackers have successfully developed a repeatable, autonomous offensive capability using open-weight AI models. The fact that the threat actor tested multiple Chinese AI models suggests they are actively evaluating which platforms work best for their attack objectives and may refine their approach over time.

The campaign also reveals a strategic preference for open-weight models, which are publicly available and can be deployed without relying on commercial API providers. This approach gives attackers more control over their infrastructure and reduces their dependence on commercial AI platforms that might implement safety measures or monitor for malicious activity.

The use of Telegram for command-and-control and the routing of Western AI tools through third-party proxies demonstrates that sophisticated threat actors are actively working to obscure their operations and maintain operational security while using AI-powered attack frameworks. The attacker's ability to autonomously pivot from failed exploitation attempts to higher-value targets suggests that AI-driven attacks may become increasingly adaptive and difficult to defend against.