Palo Alto Networks revealed that a Chinese-speaking hacker weaponized DeepSeek AI to build an autonomous attack machine capable of scanning, identifying, and exploiting nearly 460 systems with minimal human oversight. The actor, operating under the aliases knaithe and KnYuan and based in Zhuhai, combined DeepSeek with the Hermes Agent framework to create an end-to-end attack pipeline. The infrastructure primarily targeted systems running Langflow and n8n, exploiting vulnerability CVE-2026-33017. DeepSeek was favored specifically because its safety guardrails are thinner than those of Western models from OpenAI, Anthropic, or Google. The campaign’s actual impact remained limited, as basic security measures such as patching and proper authentication stopped a significant number of the automated attacks.
Source: Read the original article
