Unit 42: Hacker Uses DeepSeek + Open-Source AI Agent for Fully Autonomous Attack Campaign

Unit 42 documented a China-based actor, self-identified as knaithe or KnYuan and calling himself a binary security researcher, running end-to-end attacks with the DeepSeek reasoning model inside an open-source agentic framework in unattended YOLO mode, which executes risky commands without permission prompts. In a recovered May 2026 session the agent received only an initial task and then worked alone: it used the FOFA asset-search engine to enumerate 84 internet-exposed Langflow servers, pulled a public PoC for CVE-2026-33017, a KEV-listed unauthenticated RCE, and scanned for exploitable configs. Blocked there, it researched exploit repositories, selected n8n with its pool of 647,000 exposed instances, and attempted a chain of CVE-2026-21858 and CVE-2025-68613. The attempts failed only because the required file-upload endpoints demanded authentication. Separately, the operator manually attacked more than 460 systems and confirmed three compromises via Citrix NetScaler CVE-2026-3055, extracting appliance memory to harvest authentication cookies for session hijacking. The whole operation surfaced when the agent accidentally started a web server in its home directory, leaking API keys, exploit scripts, target lists, shell history, and attack logs.

The control that stopped the autonomous chain was a configuration choice, not a detection: authentication on file-upload endpoints. That matters because the actor's manual ceiling was roughly 460 systems with three compromises, while the agent scouted a target pool two to three orders of magnitude larger in a single unattended session, the difference Unit 42 characterized as hundreds of hours of targeting analysis compressed into minutes. Autonomy's real delta is economic: operator hours stop being the rate limiter and exploit availability takes over, so the first public bypass of one authenticated n8n endpoint would convert a 647,000-instance pool into an actionable target list almost instantly. Also note where visibility came from: the agent's own mistake, a web server serving its home directory, not any defender-controlled telemetry. Current insight into autonomous offense depends on adversary error, which is not a durable intelligence advantage.

Patch Langflow for CVE-2026-33017, n8n for CVE-2026-21858 and CVE-2025-68613, and Citrix NetScaler for CVE-2026-3055, prioritizing NetScaler since it is the only one with confirmed compromises here. Take AI orchestration and low-code platforms off the public internet, and enforce authentication on file-upload endpoints specifically, the exact control that broke this chain. Hunt for memory-extraction processes on NetScaler appliances searching for authentication cookies, for FOFA-style bulk enumeration sweeps against your egress ranges, and for unexpected web servers or directory listings in user home directories where agent sessions could be serving API keys, shell history, and target lists.

Two developments would force a reassessment. A first confirmed autonomous compromise would move this from demonstrated capability to hands-off intrusion, collapsing the remaining comfort that unattended agents fail at authentication boundaries. And any public bypass for authenticated n8n file-upload endpoints would reopen the 647,000-instance pool the agent already mapped and prioritized on its own.