Back Startupfortune

A Hacker Turned DeepSeek Into an Autonomous Weapon Against 460 Servers

Startupfortune • August 2, 2026

A Chinese hacker connected DeepSeek to the open-source Hermes Agent framework and let it autonomously scan, evaluate, and attack roughly 460 internet-facing systems, breaching three of them. Unit 42 found the hacker had tried the same workflow on Claude and OpenAI first, but their provider-side safeguards blocked it, while DeepSeek's API had no equivalent layer watching for abuse.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

DeepSeek AI Used in Autonomous Cyberattack Campaign by Chinese Threat Actor A Chinese-speaking threat actor, identified as knaithe/KnYuan, executed an autonomous cyberattack campaign using DeepSeek AI and the Hermes Agent framework. The campaign targeted over 460 servers, attempting to exploit multiple vulnerabilities, including CVE-2026-33017 and CVE-2026-21858. The attacks were conducted with minimal human intervention, as the AI autonomously handled target enumeration and exploit execution. Although the campaign did not successfully compromise most targets, it marks a significant shift in offensive cyber operations, showcasing the potential of AI in autonomous hacking. The operation was exposed when Hermes accidentally launched a public HTTP server, leaking sensitive information. Unit 42 confirmed that safety controls from OpenAI and Claude Code effectively blocked the actor's attempts to use those models, leading to the selection of DeepSeek due to its lack of guardrails. The incident highlights the operational value of AI safety controls in preventing misuse. 12 sources 60

Extracted Entities

A Hacker Turned DeepSeek Into an Autonomous Weapon Against 460 Servers

The full story

Extracted Entities

Attack Types (1)

Companies (1)

Tools (2)