What happened
A researcher operating under the aliases "knaithe" and "KnYuan," based in Zhuhai, China, built an attack system that needed almost no human input once it was pointed at a target list. Security firm Palo Alto Networks' Unit 42 found the operation after the system itself accidentally exposed it: an open web file server, left running by the AI agent inside its own working directory, handed researchers the actor's API keys, exploit scripts, target lists, shell history, and full session logs going back months.
The self-description on file was "binary security researcher." The activity Unit 42 documented was a live offensive campaign against real, internet-facing systems.
How the system worked
The operator combined an open-source agent framework called Hermes Agent, which gives a large language model (LLM) terminal access on a machine plus a command-and-control channel over Telegram, with DeepSeek's model as the reasoning engine behind it. DeepSeek is a Chinese AI lab whose models are open-weight and cheap to run compared with Western frontier models.
According to Unit 42, DeepSeek did most of the actual attack planning: it wrote search queries for FOFA, a Chinese search engine that indexes internet-connected devices and services, assessed which disclosed vulnerabilities were worth pursuing against a given target, picked which systems to go after, and adjusted exploit code when a first attempt failed, largely without the operator typing anything in between. The operator also tested other Chinese models, Qwen, GLM, Kimi and MiniMax, and briefly tried Anthropic's Claude Code and OpenAI's Codex, though Unit 42 described that use as minimal next to DeepSeek's role.
Unit 42 called out the speed of the reconnaissance phase specifically: "This autonomous process of target identification, sampling and narrowing of scope is notable because the system executed hundreds of hours of manual targeting analysis in mere minutes."
Scale and targets
The agent enumerated roughly 84 exposed Langflow instances and, by one count, more than 647,000 exposed n8n instances worldwide, including over 25,000 inside China itself. Langflow and n8n are both workflow-automation tools popular with developers building AI applications. From that pool, the system moved to active exploitation attempts against more than 460 systems.
Unit 42's own accounting lists 14 confirmed successful compromises: three Citrix NetScaler appliances and eleven Marimo notebook servers, a Python-based data notebook tool. Other outlets summarizing the report cited a smaller headline figure of three successful breaches; that appears to reflect which subset of the intrusions each summary chose to highlight rather than a contradiction of Unit 42's underlying data. One confirmed victim was a government entity in Malaysia, targeted repeatedly over multiple days; the rest of the confirmed victims were spread across two other countries. Session logs show the operation running since at least May 7, 2026.
The vulnerabilities in play
The campaign drew on a mix of recent, high-severity flaws:
| Product | CVE | CVSS | Outcome |
|---|---|---|---|
| Langflow | CVE-2026-33017 | 9.8 | Code injection |
| n8n | CVE-2026-21858 | 10.0 | Arbitrary file read |
| n8n | CVE-2025-68613 | 9.9 | Sandbox escape / remote code execution |
| Citrix NetScaler | CVE-2026-3055 | 9.8 | Successful compromise |
| Marimo Notebook | CVE-2026-39987 | 9.8 | Successful compromise |
| Apache Tomcat | CVE-2026-34486 | 7.5 | Attempted (EncryptInterceptor bypass) |
| Windows IKE VPN | CVE-2026-33824 | 9.8 | Attempted |
| PAN-OS User-ID Portal | CVE-2026-0300 | - | Attempted, proof of concept did not work |
The Apache Tomcat flaw in that list got a second life this week on its own merits: the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-34486 to its Known Exploited Vulnerabilities catalog on August 5, alongside a separate Langflow flaw (CVE-2026-9198) and an N-able N-central bug (CVE-2026-18556), giving federal agencies until August 7 to patch. Tomcat's fix has been available since April, in versions 11.0.21, 10.1.54 and 9.0.117.
Why it matters
Unit 42's broader point is about barrier to entry rather than any single intrusion: "The technical barrier to AI-augmented offensive operations is low and continues to decrease." What used to require a team doing manual reconnaissance, CVE triage and exploit adaptation was run here largely by one person supervising an agent loop. Nothing in the toolchain, Hermes Agent, FOFA, or DeepSeek itself, is exotic or hard to obtain; all of it is public.
The operation was also caught by an ordinary operational-security mistake, not by anyone detecting the attacks themselves. That is worth sitting with: the same automation that let one operator run reconnaissance at machine speed also ran with none of the caution a human operator might have applied to its own infrastructure.
What this means in practice
Anyone running Langflow, n8n, Citrix NetScaler, Marimo notebooks, or Apache Tomcat should treat the CVEs above as a checklist, not background noise, given at least two of them were used in confirmed breaches and one is now on CISA's actively-exploited list with a federal deadline. More broadly, the economics Unit 42 describes, cheap open-weight models turning weeks of manual vulnerability triage into minutes, argue for shortening patch cycles on anything internet-facing rather than assuming obscurity buys time. If a lightly supervised agent can scan hundreds of thousands of exposed instances and prioritize the exploitable ones without much human input, the old assumption that unpatched systems have days or weeks before someone notices no longer holds.
