Attacker wires DeepSeek into an agent to hunt and exploit exposed servers

Palo Alto Networks Unit 42 detailed a Chinese-speaking attacker who used the DeepSeek model as the reasoning engine inside an open-source agent called Hermes to attack exposed servers with little human input. Taking instructions over Telegram and using an internet asset search engine, the agent ran in a mode that executes commands without asking permission: from a single task, it downloaded a public exploit, enumerated vulnerable Langflow and n8n instances, judged targets by value, and attempted exploitation on its own. The autonomous attempts failed, blocked by authentication and configuration, though the operator succeeded manually elsewhere. The operation was exposed when the agent accidentally served its own working directory over the web.

Check

Keep self-hosted tools like n8n and Langflow patched, authenticated, and off the public internet, since autonomous agents now scan asset search engines and attempt exploitation without a human in the loop.

Affected

Organizations exposing self-hosted AI and automation tools such as Langflow and n8n; autonomous AI agents can discover, rank, and attack them at scale, though basic authentication and hardening blocked the observed attempts.

Fix

Require authentication, disable risky auto-login options, restrict management interfaces, and patch known flaws, since the defensive configurations that stopped this agent are the same controls that blunt automated exploitation generally.