Chinese-speaking cybercriminal uses DeepSeek within Hermes framework via Telegram, leverages FOFA and GitHub exploits, breaches three organizations, accidentally leaks sensitive files

A news report in The Hacker News on 31 July 2026 has described how a Chinese-speaking threat actor had used DeepSeek as the core reasoning engine in an autonomous hacking setup that scanned more than 460 targets and successfully breached at least three organizations.

Additionally, the operation came to light only after the AI system made a mistake and exposed its own working environment, including sensitive files, to outside observers.

The actor, identified by the aliases knaithe and KnYuan, ran DeepSeek inside the open-source Hermes Agent framework and controlled it through Telegram, then allowed it to operate with little to no direct human intervention. From there, the system carried out reconnaissance on internet-facing targets through FOFA, pulled public exploit code from GitHub, and tried to use it against selected systems on its own.

Attack mechanics

In one recovered session from May 2026, the agent first pursued a Langflow flaw, CVE-2026-33017, but gave up after determining that all 84 instances it found did not have the required configuration for exploitation. From there:

• It then broadened its search across 10 product families
• Looked up trending proof-of-concept exploits on GitHub
• Shifted attention to n8n workflow automation software, where it tried a chain involving CVE-2026-21858 and CVE-2025-68613
• Even though it found more than 25,000 exposed n8n installations in China, every one of them still required authentication, so the autonomous attempt did not lead to compromise
• The same actor also carried out separate manual operations that did succeed, including confirmed data theft from three organizations by exploiting CVE-2026-3055. One of those campaigns repeatedly targeted a Malaysian government entity over several days, showing that the actor combined autonomous AI-driven reconnaissance with traditional hands-on intrusion work
• The malicious actor experimented with other Chinese-market models, including Qwen, GLM, Kimi, and MiniMax. There were also signs of limited use of Western tools such as Claude Code for connectivity checks, and Codex in exploit-development directories, while proxy infrastructure and disabled logging were used to reduce the chances of attribution.

DeepSeek was likely selected because of its weaker safety controls and because it was accessed through a framework with no client-side restrictions, according to various reports. For defenders, the biggest lesson is that the attacker’s automation had helped to reveal the operation. When Hermes Agent launched `python3 -m http.server 8888` from the attacker’s working directory, it had accidentally exposed API keys, exploit scripts, target lists, and session logs to the public.

The deeper concern is not whether any single campaign succeeded, but that the technical barrier to AI-assisted offensive operations is already low and still dropping. Researchers are advising prompt patching of Langflow, n8n, Marimo, and NetScaler systems, along with tighter control over unnecessary public access to workflow interfaces.