Reported by 2 outlets
Chinese Hacker Uses DeepSeek AI to Automate Vulnerability Exploitation
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.56 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
update from cyberpress.org
Chinese Hacker Uses DeepSeek AI to Automate Vulnerability Exploitation
cyberpress.org · 52d ago · August 22nd, 2026
A Chinese-speaking threat actor has been observed using DeepSeek AI as an autonomous offensive operator to identify exposed infrastructure, research vulnerabilities, acquire public proof-of-concept exploits, and launch attacks with minimal human intervention. Palo Alto Networks Unit 42 tracked the activity to an actor known as knaithe and KnYuan, describing the campaign as an early but functional example of end-to-end AI-assisted cyberattack automation. While the autonomous operations produced limited confirmed impact, the researchers warned that the campaign demonstrates how large language models can accelerate vulnerability research, target prioritization, and exploitation workflows. Chinese Hacker Uses DeepSeek AI The actor primarily used DeepSeek through the open-source Hermes Agent framework, which supplied terminal access, a skill system, and Telegram-based command-and-control capabilities. DeepSeek acted as the reasoning engine, making decisions about target selection, code generation, vulnerability assessment, and follow-on actions. The threat actor customized Hermes Agent with red-teaming capabilities, including a “godmode” jailbreak feature, an unauthenticated WebSocket exploitation workflow, and a FOFA internet asset search tool. Attack flow (Source: Palo Alto Network) The environment also integrated an MCP server that enabled FOFA searches, Nuclei scan generation, and natural-language conversion of prompts into FOFA queries. Investigators found that the actor had
-
update from gbhackers.com
Chinese Hacker Uses DeepSeek and Hermes Agent to Launch Autonomous Cyberattacks
gbhackers.com · 52d ago · August 22nd, 2026
According to Unit 42, the actor tracked under the aliases knaithe and KnYuan built an AI-assisted offensive environment that combined DeepSeek’s reasoning capabilities with Hermes Agent’s terminal access, […] The post Chinese Hacker Uses DeepSeek and Hermes Agent to Launch Autonomous Cyberattacks appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .