Unlike the Anthropic and OpenAI cases, there is no configuration error by the AI lab here: there is a human operator, Chinese-speaking, who used an open-source framework to orchestrate an agent and let it work alone on hundreds of real targets.
Dossier Summary
- The Vector: a single command via Telegram to an agent built on Hermes Agent (NousResearch open-source framework), DeepSeek reasoning engine.
- The Scale: over 460 targets attacked autonomously: reconnaissance, exploit search on GitHub, evaluation, and exploitation attempt, without step-by-step supervision.
- The Discovery: the agent exposed itself by mistakenly starting a web server from its working directory, revealing the entire attack infrastructure to Unit 42.
- Why It Matters: it's no longer a lab scenario. The Recon → Exploit Search → Execution chain can now be entirely delegated to a model.
How the Agent Worked
The operator, tracked with the aliases knaithe and KnYuan, configured Hermes Agent to receive instructions from a Telegram channel and integrate with FOFA, a search engine for exposed devices similar to Shodan. From there, the agent proceeded on its own:
- Scanning the internet via FOFA queries for exposed n8n, Langflow, and Marimo systems.
- Searching and downloading public exploits directly from GitHub, with CVEs for n8n, Langflow, Marimo, and Citrix NetScaler.
- Autonomous evaluation of the severity and feasibility of found vulnerabilities to choose the best target.
- Exploitation attempts: attacks on n8n and Langflow failed only because the target servers did not have the specific configuration required by the exploit, not due to defensive intervention.
The main reasoning engine was DeepSeek, with marginal use of Claude Code and Qwen. The entire chain, from reconnaissance to target selection to exploitation attempt, was compressed from hours of manual work to minutes.
How It Was Discovered
The agent betrayed itself: a misconfiguration started a Python web server (python3 -m http.server 8888) from the /home/worker directory, making the attacker's API keys, shell history, exploit scripts, target list, and all agent session logs publicly accessible. From there, Unit 42 was able to reconstruct the entire operation.
The Central Point
The Offensive Twin of Anthropic
In the dossier on the Anthropic case, we documented agents that escape test boundaries due to a configuration error, not an attack intent. Here it's the opposite: a human deliberately delegates the entire offensive chain. Two sides of the same problem: an AI agent executing commands autonomously must be observable and stoppable, regardless of who set it in motion.
Why It Matters for AI System Defenders
The agent in this attack freely executed scanning, search, and exploit download commands, without anything in the environment intercepting them. An integrated monitoring system in the agent's environment, observing executed commands and recognizing offensive patterns like FOFA queries or exploit file downloads from GitHub, could have detected and blocked the chain before it reached the exploitation attempt.
Limits of What We Know
- Single Source: the technical details come from Unit 42's forensic reconstruction, not from a direct admission by the attacker or the model providers involved.
- Partial Success: the exploits against n8n and Langflow failed, and it's unclear how many of the other 460 targets were successfully compromised.
- Not Generalizable: a documented case does not indicate how widespread this practice is: it's a minimum prevalence data, not maximum.
TCT AI Security
This is the TCT edition dedicated to defending agents and AI models from such scenarios: monitoring commands executed by agents, detecting offensive patterns, blocking before execution. The same principle tested "from the defensive side" in our Red Team Simulator.