In short: On 30 July 2026 Palo Alto Networks' Unit 42 documented the first confirmed real-world campaign in which a neural network — DeepSeek — searched for vulnerable servers, picked exploits and tried to break in almost entirely on its own. Of roughly 460 targets, only three intrusions were confirmed, but the precedent is what matters: the skill barrier for mass attacks is dropping fast. Here is what it means for protecting your data.
What happened
Unit 42, the threat-intelligence arm of Palo Alto Networks, traced the operation to a Chinese-speaking actor using the aliases knaithe and KnYuan, assessed to be based in Zhuhai, China. The operator wired DeepSeek into the open-source Hermes Agent framework, turning the model into an autonomous offensive tool that took commands over Telegram — a single message was often enough to launch a full scan-and-exploit run. Alongside DeepSeek, the actor also tested Qwen, GLM, Kimi and MiniMax. Notably, researchers say the operator turned to these models precisely because the safety controls of Western systems, including Claude and OpenAI, blocked offensive use. This is the same trend we tracked in our report on the surge in AI-powered cyberattacks.
How the autonomous attack worked
The result was a working "scan → research → exploit" pipeline. The agent searched for exposed servers through the FOFA search engine, analysed known vulnerabilities, pulled ready-made proof-of-concept code from GitHub and launched checks — with the human largely stepping back. In one run it targeted the AI tool Langflow via CVE-2026-33017 (CVSS 9.8), enumerated 84 instances and found one vulnerable host; in another it surveyed more than 647,000 reachable n8n automation instances. Across the campaign it probed over 460 targets and around ten product families.
What actually succeeded — and why it is worrying
The good news is the low hit rate: Unit 42 confirmed only three successful compromises — memory data exfiltration from Citrix NetScaler devices (CVE-2026-3055), plus command execution on eleven Marimo servers and attempts against a Malaysian government entity, Apache Tomcat and a VPN appliance. The campaign was ultimately exposed by the attacker's own mistake: the Hermes Agent launched a file server in the home directory instead of an isolated folder, leaving API keys, tooling and operation logs open to the world. The worry is not this particular hit rate but the direction of travel — a system that can autonomously scan hundreds of thousands of hosts and try exploits at machine speed makes opportunistic mass attacks cheaper for everyone.
What it means for an ordinary person
You are not the direct target of a campaign like this, but you feel its consequences. When automation lets one operator scan the whole internet and try known exploits at scale, more servers get breached — and the databases behind them hold your logins, emails and phone numbers. Most of these attacks rely on known vulnerabilities that were never patched, and on services needlessly exposed to the internet. That is exactly the surface good hygiene shrinks.
How do you protect yourself?
Update everything. Autonomous bots hunt for the specific unpatched CVEs above. Timely updates to your OS, apps and routers close the very doors they knock on.
Use unique passwords and 2FA. If a service you use is breached, unique passwords and two-factor authentication keep the damage from spreading to your other accounts.
Reduce your exposed surface. Do not expose home devices — cameras, NAS, routers — directly to the internet. A no-logs VPN encrypts your connection on untrusted networks so that a scanner on the same Wi-Fi cannot see your traffic or the services you reach. An honest limit: a VPN does not patch someone else's vulnerable server, but it shrinks what an automated scanner can learn about you. LiMP VPN is a no-logs service for iOS and Android — see the plans, and follow more privacy news on our blog.
Sources
This report is based on the investigation by Palo Alto Networks Unit 42 and reporting by BleepingComputer and SecurityLab.ru, which independently described the autonomous AI attack campaign.