DeepSeek-Powered Hermes Agent Launches Autonomous Cyberattacks Against Exposed Servers

A Chinese-speaking threat actor used an AI-driven agent to search for vulnerable internet-facing servers and begin attacks with little direct human input.

The campaign shows how automated tools can now move from finding targets to testing public exploits in a single workflow.

The activity focused on exposed Langflow and n8n systems, before the operator also used traditional tools against Citrix NetScaler devices, Marimo notebooks, Apache Tomcat servers, and VPN endpoints.

Although the AI-led attacks did not fully compromise their intended targets, the wider operation caused confirmed data theft and command execution.

Researchers at Unit42 identified the campaign after the Hermes Agent mistakenly exposed its own working environment through an internet-accessible file server.

That error gave analysts visibility into attack scripts, target lists, API configurations, command history, and autonomous-session logs.

Palo Alto Networks said in a report shared with Cyber Security News (CSN) that the case is important because it documents a working offensive process rather than a theoretical risk.

AI helped the operator compare vulnerabilities, locate public proof-of-concept code, narrow a large target pool, and launch exploit attempts at a pace that would normally require far more manual effort.

DeepSeek-Powered Hermes Agent

The actor used Hermes Agent as the operational framework and DeepSeek as the reasoning engine.

Hermes supplied terminal access, a skills system, and Telegram-based command control, while the model assessed targets, generated commands, gathered exploit tools, and decided where to focus next.

The setup included customized red-team skills for bypassing model restrictions, exploiting unauthenticated web services, and searching internet-connected assets.

This makes the activity more concerning than simple AI-assisted scripting, since the system was configured to carry out a repeatable scan, research, and attack cycle.

The autonomous session first examined a Langflow flaw and searched for reachable deployments. It found one potentially vulnerable system, but the exploit needed conditions that were not present, so the agent judged the target family as low value and moved on.

It then compared deployment numbers and public exploit availability across 10 product families before selecting n8n.

That choice reflected the agent’s ability to weigh severity, likely reach, and exploit prerequisites, risks also highlighted in reporting on critical n8n server takeover flaw affecting exposed automation systems.

The agent checked about 100 n8n addresses from a much larger pool, examined roughly 40 distinct systems, and identified three running affected versions.

Exploitation attempts ultimately failed because the exposed form endpoints required authentication, but the narrow failure margin is the key concern for defenders.

Unit42 said the model independently changed direction after its initial effort failed, rather than waiting for an operator to provide a new target.

This attack flow illustrates the complete progression from the initial Langflow effort to the later n8n targeting.

Exposed Infrastructure Raises Risk

The same actor separately ran manual campaigns with confirmed impact. Unit42 confirmed successful exploitation of three targets through a Citrix NetScaler memory-read vulnerability, with stolen memory searched for authentication-cookie material that could support session hijacking.

That activity aligns with active NetScaler exploitation warnings that urged organizations to prioritize remediation of the actively exploited weakness.

The actor also achieved command execution on Marimo notebook instances and attempted reverse-shell access against Tomcat and VPN targets.

The AI campaign exposed an operational weakness on the attacker’s side. Hermes started a web file server from the operator’s home directory instead of an isolated staging location, unintentionally revealing data that otherwise could have been erased after an attack.

The autonomous AI attack cycles are operationally viable, even if this campaign’s automated attempts did not produce a full compromise.

The findings reinforce concerns around risks from exposed AI agents that hold broad access to systems and credentials.

Organizations should patch vulnerable internet-facing applications quickly, require authentication on public workflow forms, and reduce direct exposure of automation platforms.

Security teams should also review logs for unusual scanning, unexpected workflow changes, and outbound connections from systems that should not initiate them.

Asset inventories should be checked for externally reachable Langflow, n8n, and NetScaler deployments, while exposed services should be segmented where possible.

Administrators can also use recent workflow automation security gaps to review access controls, node permissions, and patch management practices.

Indicators of Compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.