In the wild
Realized harm
Chinese-speaking actor runs an autonomous DeepSeek/Hermes Agent offensive campaign against internet infrastructure
AIR-2026-0175 AIR record · 2026-07-unit42-hermes-agent-autonomous-campaign
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
The actor, operating under the aliases knaithe and KnYuan, leveraged DeepSeek, via the Hermes Agent framework, as their autonomous offensive operator.unit42.paloaltonetworks.com
The record
Disclosed
2026-07-30
Occurred
2026-05-01
Vendor
DeepSeek / Hermes Agent
Product
DeepSeek models driven by the Hermes Agent framework
Risk domain
Access control and permissions › Privilege escalation
Also touches
Data exfiltration channels
System type
Generative model
Who acted
Agent acted — the agent enumerated targets, sourced exploits and executed commands
Attack surface
Autonomous operations
Autonomy level
Fully autonomous
Initial vector
Attacker operated agent
Impact type
Data exfiltration, Remote code execution, Unauthorized access
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
Internet-facing Citrix NetScaler and Marimo notebook instances across three countries; a Malaysian government entity targeted manually
Capability abused
Taxonomy & references
Curator notes
Attacker-side abuse of an agent rather than a victim-side agent compromise. Unit 42 confirms data exfiltration from three Citrix NetScaler targets and command execution on eleven Marimo notebook instances; the actor also tested Claude Code, Codex, Qwen Code, GLM, Kimi and MiniMax and orchestrated via Telegram.
Supporting sources
Cite as
Enkrypt AI. "Chinese-speaking actor runs an autonomous DeepSeek/Hermes Agent offensive campaign against internet infrastructure". AIR, AIR-2026-0175. https://agentincident.vercel.app/i/AIR-2026-0175/ (accessed 2026-10-19).