Chinese Hacker Uses DeepSeek and Hermes Agent to Launch Autonomous Cyberattacks

Gbhackers •Eswar • August 22, 2026

A Chinese-speaking threat actor has been observed using DeepSeek through the Hermes Agent framework to automate reconnaissance, vulnerability research, exploit acquisition, and attack attempts against internet-facing infrastructure. According to Unit 42, the actor tracked under the aliases knaithe and KnYuan built an AI-assisted offensive environment that combined DeepSeek’s reasoning capabilities with Hermes Agent’s terminal access, […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Chinese Hackers Leverage DeepSeek AI for Increased Cyberattacks Chinese state-affiliated hacking groups have significantly increased their cyberattack volume by integrating DeepSeek and other open-source AI models into their operations. According to TeamT5, a Taiwanese cybersecurity firm, these groups have more than doubled their attacks since adopting AI to automate routine tasks and develop sophisticated malware. DeepSeek's low operational costs and customizable features make it particularly appealing to hackers, despite the availability of more powerful models like Moonshot's Kimi K3, which remains too expensive for widespread use. Specific groups such as Grimfengxi, Huapi, and Teleboyi have been identified using DeepSeek for various attack stages, including reconnaissance and exploit code generation. Additionally, some hackers have utilized US-developed AI tools like ChatGPT during their operations. The trend indicates a shift towards using more accessible AI tools to enhance the scale and effectiveness of cyberattacks. 13 sources 76

Extracted Entities

Tools (2)

DeepSeek Hermes Agent