Autonomous AI Hackers Are Here: How A Chinese-Speaking Actor Ran A 460-Target Campaign With Off-the-Shelf LLMs + Video

Introduction

On August 18, 2026, CISA added four CVSS 9.x vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, mandating a three-day federal patch deadline. Hours earlier, a China-1exus advanced persistent threat (APT) actor had already exploited a VMware vCenter path traversal flaw across 361 organizations in 47 countries. The same alert revealed something unprecedented: a Chinese-speaking actor had just executed the first end-to-end autonomous AI hacking campaign against 460 targets — using DeepSeek for reasoning, Hermes Agent for terminal orchestration, Telegram for command-and-control, FOFA for reconnaissance, and public GitHub exploits. No model training. No zero-day development. Just a prompt a 10-year-old could write.

The operation exposed a fundamental shift: the barrier to entry for offensive cyber operations has collapsed. The same AI stack that builds a startup now runs a 460-target attack campaign. This article breaks down the technical architecture, the vulnerabilities exploited, the operational security failures, and what defenders must do now.

Learning Objectives & Secrets

Objective 1: Understand the Autonomous Attack Chain — Learn how DeepSeek, Hermes Agent, FOFA, and public PoCs compose a fully autonomous, end-to-end offensive AI pipeline that enumerates targets, researches vulnerabilities, downloads exploits, and executes attacks without human intervention.
Objective 2 (Secret Tip): Exploit the AI’s Operational Security Blind Spots — The same autonomy that enables speed introduces novel forensic artifacts. Hermes Agent started a file server from the wrong directory, exposing the actor’s entire workspace — including AI configurations, API keys, exploit scripts, target lists, and session logs. Defenders can hunt for these artifacts.
Objective 3 (Secret Tip): Bypass Provider Safeguards with Permissive Models — Western models (Claude Code, Codex) refused and disabled tied accounts. The actor pivoted to DeepSeek — a model with minimal safety controls, accessed through an open-source framework with no client-side restrictions. The path of least resistance wins.

You Should Know

1. The Autonomous Attack Stack: Architecture & Configuration

The actor assembled an integrated offensive AI environment:

||-|||

The actor customized Hermes Agent with three red-teaming skills:
– godmode: LLM jailbreaking (framework-bundled)
– web-terminal-exploitation: unauthenticated WebSocket exploitation (custom)
– fofa-cyberspace-search: instructs DeepSeek to use fofoapi.py for internet asset enumeration

They also integrated the open-source FofaMap MCP server, exposing FOFA asset search, Nuclei scan generation, and a DeepSeek-powered natural-language-to-FOFA query translator.

Anti-Attribution Configuration:

 Claude Code
export CLAUDE_CODE_ATTRIBUTION_HEADER="0"
export CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC="1"

Codex
 disable_response_storage = true  Limits local response storage

Both Western tools were routed through a third-party proxy (code.newcli[.]com) to reduce traceability, while DeepSeek and Qwen were accessed directly through native API endpoints.

The Autonomous Attack Cycle: From Target Enumeration to Exploitation

The Hermes Agent, with DeepSeek as its reasoning engine, executed a complete attack lifecycle without human intervention beyond the initial Telegram directive.

Phase 1: Langflow Exploitation (CVE-2026-33017, CVSS 9.8)

DeepSeek identified a Langflow vulnerability and autonomously:

1. Downloaded the public PoC from GitHub

2. Enumerated 84 Langflow instances via FOFA (`title=”Langflow”`)

Ran the PoC scanner: `langflow_poc.py –scan-file langflow_targets.txt –threads 10`

4. Identified one vulnerable target (Langflow 1.3.4)

The exploitation failed because the vulnerability requires either `auto_login` enabled or a public flow ID — the target had neither.

Phase 2: Autonomous CVE Research & Target Selection

After abandoning Langflow, DeepSeek conducted autonomous research:

Surveyed deployment counts across 10 product families via FOFA
Searched GitHub for trending 2026 CVE PoC repositories sorted by stars
Evaluated each candidate by severity, deployment footprint, and exploitability

DeepSeek selected n8n as the next target: FOFA confirmed 647,017 instances globally, 25,209 in China.

Phase 3: n8n Vulnerability Chain (CVSS 10.0 + 9.9)

DeepSeek obtained the public n8n exploit PoC (Chocapikk/CVE-2026-21858), chaining two CVEs:
– CVE-2026-21858: arbitrary file read (CVSS 10.0)
– CVE-2025-68613: sandbox bypass to RCE (CVSS 9.9)

Patched in n8n 1.121.0 and 1.120.4 respectively.

Phase 4: Target Enumeration & Exploitation Attempts

DeepSeek ran FOFA queries targeting Chinese n8n instances and probed for version and form endpoints. Three instances were confirmed vulnerable (v1.18.0, v1.117.3, v1.108.2). One target exposed three form endpoints — all required authentication. DeepSeek launched parallel scanning across 50+ remaining Chinese targets. None had publicly accessible forms.

Key Insight: The autonomous process executed hundreds of hours of manual targeting analysis in minutes, while managing its own compute resources — sampling approximately 100 IP addresses out of 25,209, probing roughly 40 unique IPs, and checking versions via curl commands.

3. Manual Campaigns: Where the Actor Succeeded

While the autonomous AI campaign failed to achieve compromise, the actor conducted manual operations with confirmed impact:

|–|||–|

| CVE-2026-3055 | Citrix NetScaler ADC & Gateway | 9.8 | Data exfiltration from 3 organizations |
| CVE-2026-39987 | Marimo Notebook | 9.8 | Command execution on 11 instances |
| CVE-2026-34486 | Apache Tomcat | 7.5 | Reverse shell attempts against 9 servers |
| CVE-2026-33824 | Windows IKE Extensions (IKE VPN) | 9.8 | Reverse shell attempts against 3 endpoints |

The actor exfiltrated memory data through the Citrix NetScaler out-of-bounds memory read vulnerability and searched for authentication cookies (NSC_AAAC=) — indicating session hijacking intent. They persistently targeted a government entity in Malaysia over multiple days, refining memory grooming parameters and using proxy anonymization.

The AI That Exposed Itself: Operational Security Failures

The actor demonstrated operational security awareness elsewhere — emptying exploit directories after use and disabling Codex conversation logging. But the Hermes Agent, responding to a Telegram command, started an HTTP file server from the wrong directory:

python3 -m http.server 8888

Executed from `/home/worker` rather than an isolated staging directory, this exposed the actor’s entire workspace:

AI tool configurations
API keys (including direct API endpoints)
Exploit scripts
Target lists
Bash history
Hermes autonomous exploitation session logs

The Lesson: An AI attacker leaves forensic artifacts a human doesn’t. The same autonomous capability developed for offensive use directly caused the exposure of the operation.

5. Attribution & Threat Actor Profile

The actor is based in Zhuhai, China, operating as an opportunistic exploit operator and self-described binary security researcher. GitHub activity reveals maintenance of 1DayNews — an automated vulnerability intelligence pipeline that:
– Aggregates RCE disclosures from 17 sources (primarily network perimeter vendors)
– Leverages DeepSeek to filter for exploitability
– Distributes actionable alerts via Telegram

The actor’s activity is opportunistic, with confirmed victims spanning three countries and multiple sectors. The autonomous AI campaigns targeted Chinese domestic infrastructure indiscriminately, while the manual campaign against the Malaysian target demonstrated higher intent.

6. Defensive Commands & Mitigations

For n8n instances (CVE-2026-21858 / CVE-2025-68613):

 Check n8n version
n8n --version

Update to patched versions
npm install -g [email protected]  or later
 Or via Docker
docker pull n8nio/n8n:1.121.0

For Citrix NetScaler (CVE-2026-3055):

 Check version via CLI
show version

Apply latest firmware update from Citrix
 https://www.citrix.com/downloads/citrix-adc/

For Windows IKE VPN (CVE-2026-33824):

 Check Windows version
systeminfo | findstr /B /C:"OS Name" /C:"OS Version"

Apply Microsoft security update (refer to CVE-2026-33824 advisory)
 Monitor IKE service logs
wevtutil qe System /c:50 /f:text /q:"[System[Provider[@Name='IKE']]]"

For AI Tool Security:

 Audit AI coding tools for unsafe configurations
 Check for disabled safety features
grep -r "dangerously-skip-permissions" ~/.config/
grep -r "approvalMode.yolo" ~/.config/
grep -r "disable_response_storage" ~/.config/

Monitor for unauthorized proxy usage
netstat -an | grep -E "code.newcli|api.deepseek|dashscope.aliyuncs"

Network Detection:

 Detect FOFA reconnaissance traffic
tcpdump -i any -1 'host fofa.info or port 443' -c 100

Detect Hermes Agent C2 via Telegram
 Monitor for unusual Telegram API traffic
 Look for python3 -m http.server processes in non-standard directories
ps aux | grep "http.server"

What Undercode Say

Key Takeaway 1: The technical barrier to AI-augmented offensive operations is low and continues to decrease. The actor used off-the-shelf components — DeepSeek, Hermes Agent, FOFA, and public GitHub exploits. No model training, no zero-day development. A prompt a 10-year-old could write now runs a 460-target cyber operation.
Key Takeaway 2: Provider-side safeguards work — but attackers will pivot to the most permissive models. OpenAI’s safeguards refused requests and disabled the tied account. The actor selected DeepSeek precisely because it lacks built-in safety layers. Defenders must assume attackers will use models with minimal restrictions.
Key Takeaway 3: Autonomous AI introduces novel operational security risks for threat actors — and opportunities for defenders. The Hermes Agent’s file server exposure created forensic artifacts that would not have existed under manual execution. Defenders should hunt for these artifacts: exposed AI workspaces, Python HTTP servers in home directories, and unusual API key patterns.
Key Takeaway 4: The margin of failure was narrow. Exploitation was prevented by target-side configuration — the absence of prerequisite workflow configurations (Langflow) and authentication on form endpoints (n8n). Targets with weaker default configurations would have been susceptible. This is a warning: harden configurations now.
Key Takeaway 5: The actor is iterating — refining tool configurations, developing custom skills, establishing proxy infrastructure, and executing autonomous attack cycles. The trajectory matters more than any single campaign’s outcome. This is not a one-off; it’s the beginning of a new class of AI-driven threats.

Prediction

+1 Autonomous AI hacking will become a standard capability for state-sponsored and criminal actors within 12-18 months. The toolchain is already commoditized; the only barrier is API access to permissive LLMs.
-1 Defenders are unprepared for the speed and scale of AI-driven reconnaissance. The actor executed hundreds of hours of manual targeting analysis in minutes. Traditional vulnerability management cycles (weeks to months) will be obsolete against AI that scans, researches, and exploits in real-time.
-1 The “prompt injection” and “jailbreak” arms race will intensify. As providers harden safeguards, attackers will develop more sophisticated red-teaming skills — the actor already had `godmode` jailbreaking built into Hermes Agent.
+1 AI operational security failures will become a primary source of threat intelligence. The Hermes Agent exposure is not an anomaly — autonomous systems generate logs, artifacts, and telemetry that human operators would not. Defenders who build AI-specific detection capabilities will gain asymmetric advantage.
-1 The democratization of offensive AI means smaller, less sophisticated actors can now execute campaigns that previously required nation-state resources. The barrier changed, not the ceiling. Expect a surge in AI-driven opportunistic attacks against poorly configured targets.
+1 Organizations that implement zero-trust architecture, strict authentication requirements, and hardened default configurations will remain resilient. The autonomous AI campaign failed precisely because targets required authentication and specific configurations. Defense-in-depth still works — but it must be applied now.

▶️ Related Video (76% Match):

https://www.youtube.com/watch?v=3tQnIWsPtRI

🎯Let’s Practice For Free:

🎓 Live Courses & Certifications:

Join Undercode Academy for Verified Certifications

🚀 Request a Custom Project:

Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands

IT/Security Reporter URL:

Reported By: https://lnkd.in/p/eRaPM2Hx – Hackers Feeds
Extra Hub: Undercode MoN
Basic Verification: Pass ✅

🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]

💬 Whatsapp | 💬 Telegram

📢 Follow UndercodeTesting & Stay Tuned:

𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky

Listen to this Post