Palo Alto Networks’ Unit 42 published a report this week on a Chinese-speaking operator who did what the entire security industry has spent two years warning about: he handed the attacking to a machine. Working under the aliases knaithe and KnYuan, and assessed to be based in Zhuhai, he wired DeepSeek into Hermes Agent — an open-source framework with terminal access and no built-in safety layer — and ran it from Telegram. Researchers recovered one session from early May in which they could find no operator input at all after the opening instruction. The agent picked targets, searched GitHub for public exploit code, and fired.
Across the campaign, Unit 42 counted more than 460 attempted targets. It confirmed three successful compromises. All three came from the operator’s own hands — conventional scanning and direct exploitation of a Citrix NetScaler memory-read flaw, used to pull data from three organizations and hunt through it for session cookies. The autonomous runs achieved full compromise of nothing. One attempt died because the target required authentication. Another died because a setting the agent needed was switched off.
Both halves matter. The machine did a hundred analyst-hours of work in minutes — sampling roughly 100 addresses out of 25,209 exposed instances, probing about 40, isolating three running vulnerable versions. Then it hit a login prompt and stopped. Unit 42’s framing is that the margin was narrow: what held were configuration defaults, not clever security. Looser targets would have fallen.
Our take: The scoreboard says 3-for-460, and every point was scored by the human. Read that as reassurance and you’ve read it backwards. What failed here was execution, not reconnaissance — and reconnaissance is the expensive part. The agent compressed target discovery from days to minutes and then ran into a password box. Password boxes are the cheapest thing in your stack to fix. Enumeration at machine speed is the thing you can no longer opt out of.
The model was chosen for what it wouldn’t refuse
The operator was not loyal to a vendor. Unit 42 found him configured across DeepSeek, Qwen, GLM, Kimi and MiniMax, plus limited use of two Western tools routed through an anonymizing proxy with attribution headers disabled. What he actually ran the attacks on was the stack with the fewest brakes: DeepSeek called directly at its native API endpoint, inside a framework carrying a bundled jailbreak skill.
The Western tools never got near the offensive work. Claude Code’s entire recovered history was ten entries across three sessions — model checks, connectivity tests, one package install. Unit 42’s read is that provider-side controls limited how useful those models were for autonomous attacks, pushing the operator to the most permissive option. OpenAI told the researchers its safeguards refused the policy-violating requests, and that repeated attempts got an account it links to the campaign flagged and disabled before Unit 42 ever shared intelligence with them.
This is the first campaign we’ve seen where you can watch the safety layer function as a market force. It didn’t stop the attack. It decided which company’s logs the attack showed up in.
Then the agent leaked the whole operation
Unit 42 got its visibility because Hermes Agent, told to serve some files, started a web server pointed at the operator’s home directory instead of a staging folder. Out went the tool configurations, the API keys, the exploit scripts, the target lists, the shell history and the session logs. The man was careful elsewhere — he emptied exploit directories after use and disabled conversation logging on one tool. His agent handed over the filing cabinet. Autonomous offense produces forensic evidence manual work never generates, and the model is the one deciding where it lands.
What to watch
- Authentication defaults on internal tooling. Both autonomous attempts failed on configuration — an auth requirement and a disabled setting. Automation platforms and notebook servers exposed to the internet are now the front line.
- Open-weight models plus open harnesses. The safety controls that mattered here were the provider’s, not the model’s. Anything running against a raw API endpoint has none.
- The gap closing. Unit 42’s conclusion is about trajectory, not this campaign’s box score: the operator is iterating on skills, proxies and reusable procedures. The barrier keeps dropping.