On July 31, Palo Alto Networks' Unit 42 published the first in-depth breakdown of a documented, real-world autonomous AI hacking campaign. Not a research paper. Not a theoretical risk model. A real threat actor, running real attacks, against real systems — and the only human interaction required was sending Telegram messages to a chatbot.
The attacker — tracked by Unit 42 under the aliases "knaithe" and "KnYuan" — wired together two freely available tools: DeepSeek (the open-weight Chinese model that's been making waves since January) and Hermes Agent (an open-source autonomous agent framework). They pointed it at the internet, told it which vulnerabilities to look for, and let it work.
The AI selected targets, downloaded exploits, assessed whether systems were actually vulnerable, abandoned unproductive paths, and kept going — all without human oversight between commands.
What "Autonomous" Actually Means Here
Most people still think of AI-powered attacks as AI helping a skilled hacker do their work faster. Write a phishing email. Generate some code. Polish an exploit.
This was different. DeepSeek was the brain of the operation. It:
- Generated FOFA queries (a search engine for internet-exposed systems, similar to Shodan) to find targets matching specific vulnerability profiles
- Evaluated CVE severity and deployment scale to prioritize which systems to try
- Adapted exploit logic in real time based on what it encountered at each target
- Made its own decisions — moving on from dead ends, escalating on hits
The human sent a Telegram message. The AI ran the campaign. The human checked back for results.
That's not AI assistance. That's AI doing a job.
What They Hit
Across 460+ attempted targets, Unit 42 confirmed successful exploitation at a handful of organizations. The targets that matter here are what should get your attention — because they're the same infrastructure running in thousands of small offices, public sector agencies, and NGOs right now:
Citrix NetScaler (CVE-2026-3055) — Three organizations had memory data exfiltrated via a memory overread flaw. NetScaler is the VPN and application delivery gateway that public sector orgs and mid-sized businesses use for remote access. If you're running NetScaler and haven't confirmed a patch for CVE-2026-3055, the campaign was looking for exactly that.
Marimo Notebook (CVE-2026-39987) — Command execution on 11 instances. Marimo is a reactive Python notebook that's popular with small data science teams and researchers. Not an enterprise tool — a scrappy, open-source alternative to Jupyter that a 3-person analytics team would reach for. If it's running and reachable from outside your network, this CVE is what got those 11 instances.
Apache Tomcat (CVE-2026-34486) — Also targeted. Tomcat is embedded in the guts of Java web applications, a lot of them running on-premises at exactly the kinds of orgs that haven't gotten around to migrating off legacy infrastructure.
Windows IKE VPN (CVE-2026-33824) — Also in scope.
These aren't exotic enterprise targets. They're software running in a 25-person office that hasn't had a dedicated security review in 18 months.
Why Open-Source AI Was the Key Ingredient
There's a detail in the Unit 42 report that didn't get much attention: this campaign was operationally dependent on using an open-weight model.
Major commercial AI models have content restrictions that block offensive security tasks — generating exploit queries, adapting attack scripts, identifying vulnerable targets at scale. DeepSeek, which is open-weight and runs with full control over its own behavior, has no such guardrail by default. That made the campaign possible. A closed API would have refused the work.
The security community has been debating the dual-use risk of open-source models for two years. This campaign ends that debate. The risk isn't theoretical. It's documented. It happened. And it was executed by a single individual using commodity tools that cost nothing to download.
How It Got Caught (And What That Actually Means)
The entire operation was exposed by accident. Hermes Agent, responding to a Telegram command, spun up an HTTP file server from /home/worker instead of a sandboxed directory. That mistake exposed the attacker's full environment: API keys, exploit scripts, target lists, shell history, AI attack logs.
Unit 42 found it. Published the report.
But here's what nobody's saying directly: if Hermes hadn't made that error, this campaign would still be running undetected. It wasn't caught because any organization's defenses flagged it. It was caught because the attacker's tool had a bug.
How many similar campaigns don't have that bug?
What To Do Right Now
The vulnerabilities this campaign used are patched. The question is whether your systems are.
Citrix NetScaler: Verify you're running a version that addresses CVE-2026-3055. If you run remote access through NetScaler and don't have a confirmed patch date in the last 6 weeks, treat that as an open question today.
Marimo: If anyone on your team is running a Marimo instance accessible from outside your LAN — unusual but it exists — CVE-2026-39987 is patched in recent releases.
Apache Tomcat: Check your Java web application hosts. CVE-2026-34486 affects specific versions; the Apache Tomcat project published the advisory.
Internet exposure audit: The attacker found targets through FOFA, which indexes publicly accessible services the same way Shodan does. Run a basic scan of your external IP ranges and make sure you actually know what's reachable from outside your network. A lot of orgs don't.
The Part That's Not Going Away
For years, autonomous AI attacks were a "when, not if" story. Now they're a "this happened last week" story.
The tooling is accessible. The knowledge required is minimal. The cost is close to zero. One operator in Zhuhai launched 460+ attack attempts and confirmed multiple compromises — directed by Telegram messages to a chatbot.
Small and mid-sized organizations are not too small to be on an automated scan list. Automated doesn't mean targeted — it means everything reachable gets tried. The question is whether your systems are patched when the scan reaches them.
Auditing your internet-facing services and verifying patch status against current campaigns is a standard part of how we start sprint engagements. Get in touch if you want a structured look at your exposure.