A Chinese Threat Actor Uses Autonomous AI for Cyberattacks

The researchers at Unit 42 of Palo Alto Networks have discovered a cyberattack campaign conducted by a Chinese threat actor using autonomous artificial intelligence (AI). The actor, known by the aliases knaithe and KnYuan, exploited seven vulnerabilities, combining AI's autonomous enumeration with manual exploitation, achieving confirmed impact.

The Actor's Infrastructure

The actor used DeepSeek via the Hermes Agent framework as an autonomous offensive operator. They orchestrated this operator through Telegram for the following activities:

• Independent enumeration of targets and their vulnerabilities using FOFA
• Exploitation tool sources
• Initiation of attacks without human intervention

In parallel, the actor configured multiple large language models (LLMs) such as Qwen, GLM, Kimi, and MiniMax. Limited use of Western platforms like Claude Code and Codex was also identified.

The Exploited Vulnerabilities

When initial exploitation failed due to restrictive configurations of the target environment, the Hermes agent conducted autonomous research on known critical severity vulnerabilities (CVEs). It initially examined 10 product families, scanned GitHub for trending proof-of-concepts (PoCs), and prioritized vulnerabilities based on the attack surface. This led the agent to shift to higher-value vulnerabilities, the seven described in Table 2.

Tool Configurations

The actor configured four AI coding tools to remove client-side execution permissions. They routed Western tools Claude Code and Codex through a third-party proxy service to reduce traceability.

Table 1 summarizes the configurations of each tool.

The Attack on Langflow

DeepSeek identified a vulnerability in Langflow (CVE-2026-33017, CVSS 9.8) and attempted autonomous exploitation through the following steps:

• Downloading the public PoC from GitHub
• Enumerating 84 Langflow instances via FOFA
• Running the PoC scanner
• Identifying a vulnerable target (Langflow 1.3.4)

However, the attacks failed because the vulnerability required both automatic authentication and a public flow ID, which the target did not have. DeepSeek evaluated the entire product as a low-value target.

The Attack on n8n: A High-Value Target

The choice of n8n as the primary target reveals sophisticated selection criteria:

• Global Distribution: With over 647,000 instances exposed globally, n8n represents a broad target for chained attacks.
• CVE Combination: The chained exploitation of CVE-2026-21858 and CVE-2025-68613 demonstrates the ability to exploit complex vulnerabilities.
• Exploitability: The vulnerability only required an unauthenticated module, lowering the technical barrier for the attack.

Threat Response and Mitigation

To counter this new generation of threats, security experts recommend:

• Continuous Monitoring: Implement anomaly detection solutions that can identify suspicious autonomous behaviors.
• Patch Management: Prioritize updating software with known vulnerabilities, especially widely distributed ones like n8n.
• AI Capability Assessment: Use services like Unit 42 AI Security Assessment to identify potential weaknesses in your infrastructure.

Open Questions and Future Directions

This campaign raises important questions:

• Scalability: How easily could this methodology be replicated by other actors?
• Resilience: How might these autonomous agents evolve to evade future countermeasures?
• Accountability: Who is responsible when an autonomous AI agent commits criminal acts?

As technology continues to advance, the field of automated cybercrime will present an increasing challenge to global cybersecurity. The community must collaborate to develop proactive solutions that can keep pace with these emerging threats.

Resources for Further Exploration

For more information on this topic, it is recommended to consult:

• DeepSeek
• FOFA
• Unit 42 Frontier AI Defense