Unit 42: The Autonomous Attack Loop Is Viable, and Every Confirmed Success Was Manual

On 30 July 2026, Palo Alto Networks' Unit 42 published an investigation of a Chinese-speaking operator who had wired a language model into the attack loop itself: DeepSeek running inside Hermes Agent, an open-source terminal agent from Nous Research, taking instructions over Telegram. The operator attempted more than 460 targets and kept exploit tooling for seven vulnerability tracks spanning eight CVE identifiers. Almost nothing the machine did unaided produced a compromise — both autonomous exploit attempts died on prerequisites the targets had already switched off. What a person drove did produce impact: memory data exfiltrated from three Citrix NetScaler deployments, command execution confirmed on eleven Marimo notebook instances, and a Malaysian government system worked over several consecutive days. No victim is named in either cited report, and the whole account was reconstructed from the operators' own exposed servers. The complete record, with the archive's severity grading and cited sources, is indexed in the Orca AI Incident Archive, alongside the neighbouring entries from the same week.

How the operation came into view

Unit 42 did not detect this campaign. The operator's own agent handed it over. Responding to a Telegram command, Hermes Agent started an HTTP file server — python3 -m http.server 8888 — from the actor's home directory at /home/worker rather than from an isolated staging directory. One default behaviour exposed the workspace: AI tool configurations, API keys, exploit scripts, target lists, bash history and the Hermes autonomous session logs that Unit 42 would later use to reconstruct the attack cycle step by step.

Unit 42 describes the exposure as unintentional, and records that the actor was not careless elsewhere: exploit directories were emptied after use, and conversation logging in Codex was disabled to limit local response storage. Cloud Security Alliance's AI Safety Initiative, which analysed the same disclosure on 4 August 2026, drew the sharper point: the operator practised conventional tradecraft, but the agent framework's convenience defaults undid it in a single step — and attackers who adopt agent frameworks inherit their defaults along with their capabilities.

Who the operator is, on the evidence available

Unit 42 names the actor only by handle: knaithe and KnYuan. The Zhuhai assessment rests on GitHub activity, in particular the actor's maintenance of 1DayNews, an automated vulnerability-intelligence pipeline that aggregates remote code execution disclosures from 17 sources, mostly network-perimeter vendors, uses DeepSeek to filter them for exploitability and distributes alerts over Telegram. In an interview with Infosecurity Magazine on 31 July 2026, Andy Piazza, senior director of threat intelligence at Unit 42, described the same individual as "an opportunistic exploit operator and self-described binary security researcher".

Nothing in either cited report alleges state sponsorship. CSA's note states that the disclosure identifies no state-sponsorship indicators, and reads the resourcing and scope as consistent with one person assembling an offensive workflow out of a commodity reasoning model and a freely available agent framework. Infosecurity Magazine reports that the campaign's targets spanned three countries, including China and Malaysia.

The autonomous half: two products, two failures

Unit 42 recovered one complete Hermes Agent session, dated May 2026, and could not recover operator input beyond the opening task. What the logs show is an agent choosing its own targets, and abandoning them, without instruction.

It began with Langflow and CVE-2026-33017, CVSS 9.8. It downloaded the public proof of concept from GitHub, enumerated 84 Langflow instances through the Chinese asset search engine FOFA using the query title="Langflow", and found one running a vulnerable build, 1.3.4. The attempt failed because the flaw needs either auto_login enabled or a public flow ID, and the target had neither. The agent's own verdict, quoted in the report: "All three Langflow need public flow ID but no auto_login — stuck. Deployments small (84 alive), exploitable probably 0. Search for larger-scale vulns."

It then did what its brief had not asked. It surveyed deployment counts across ten product families on FOFA, searched GitHub for trending 2026 CVE proof-of-concept repositories sorted by stars, and ranked candidates by severity, footprint and exploitability before settling on n8n — justified in the log by the proof of concept's 258 stars and CVSS 10.0. FOFA put n8n at 647,017 instances worldwide, 25,209 of them in China.

The n8n chain was CVE-2026-21858, arbitrary file read at CVSS 10.0 and patched in 1.121.0, plus CVE-2025-68613, a sandbox bypass to remote code execution at CVSS 9.9 and patched in 1.120.4. The agent checked the version ranges itself — "CVE says fixed in 1.121.0 for AFR and 1.120.4+ for RCE. So v1.117.3 is vulnerable to both!" — then sampled roughly 100 addresses out of the 25,209, probed about 40 of them, and found three running vulnerable versions: 1.18.0, 1.117.3 and 1.108.2.

All three failed for the same reason. The exploit needs an unauthenticated form with file upload, and the forms it reached required authentication. The agent said so in the log — "These forms have auth enabled. Let me check other targets" — scanned 50-plus further Chinese targets, found no publicly accessible forms, and stopped. The recovered session ends there. Unit 42 records no exploitation from the autonomous track at all.

Where the harm actually landed

Every confirmed impact in the record came from the manual track, run with conventional workflows: FOFA enumeration, custom Python scanners and direct exploitation.

• Citrix NetScaler ADC and Gateway, CVE-2026-3055, CVSS 9.8 — data exfiltrated from three organisations. Unit 42 says the three successes pulled memory data out through the out-of-bounds read, and that the actor then searched the stolen contents for NetScaler authentication cookies (NSC_AAAC=), which points at session hijacking rather than theft for its own sake.

• A government entity in Malaysia — targeted persistently and exploited over multiple days, with what Unit 42 calls memory grooming parameters and maximum read attempts, and with proxy anonymisation added on subsequent visits. This is the one target the report treats as showing intent beyond opportunism.

• Marimo notebooks, CVE-2026-39987, CVSS 9.8 — command execution confirmed on 11 instances.

• Apache Tomcat, CVE-2026-34486, CVSS 7.5 — reverse-shell attempts against nine servers.

• Windows IKE VPN, CVE-2026-33824, CVSS 9.8 — reverse-shell callbacks aimed at three endpoints.

• PAN-OS User-ID Authentication Portal, CVE-2026-0300, CVSS 9.8 — a public research proof of concept cloned and never executed. Unit 42 found the code non-functional, with placeholder values that cannot achieve execution.

Two limits matter. The victims are not named, so the identity of the three NetScaler operators and of the Malaysian agency is not public. And Unit 42 says it reviewed evidence of batch exploitation against an unknown number of hosts that appeared in a file the actor deleted before analysis — which makes the confirmed count a floor, not a total.

What is established, and what is asserted

The mechanics are unusually well evidenced for an incident of this kind. Unit 42 is reading the operator's own configuration files, session logs, target lists and bash history; the CVE list, the target counts and the failure modes come out of that material rather than from inference about network traffic.

The attribution is softer. "Chinese-speaking", "based in Zhuhai" and the handles knaithe and KnYuan are analyst assessments built on GitHub activity, an older personal blog and the 1DayNews pipeline. No charges, sanctions or government statement accompany them, and neither cited report names a victim organisation.

One enforcement claim is second-hand inside the report itself. Unit 42 relays that OpenAI's staff confirmed their provider-side safeguards refused requests that violated policy, and that continued attempts led their safety systems to flag and disable an account they believe is linked to this campaign, before Unit 42 shared its intelligence with them. That is a vendor describing its own enforcement; Unit 42 did not independently verify it.

One gap is worth stating plainly: no Malaysian government, MyCERT or other national CERT statement about this campaign surfaced in searches for this article as of 30 October 2026. Hunt.io, the second cited source for this record, says it notified the affected organisations and the relevant national CERTs on 6 July 2026 and held publication for a seven-day disclosure window — but a notification is not a public account.

The two cited reports do not agree about Claude Code

This record cites two vendor investigations published two weeks apart, and they describe different tooling splits. Unit 42, writing on 30 July, assigns execution to Hermes Agent with DeepSeek as the reasoning engine, and treats Claude Code as a trial. The recovered history is ten entries across three sessions containing /model checks, connectivity tests and one npm install request, used for connectivity testing and proxy validation. Codex shows signs of use on exploit-development directories but its chat logs were not preserved; Qwen Code got two sessions. Unit 42 reads the spread as an operator shopping across the AI market, routing the Western tools through a proxy at code.newcli[.]com while calling DeepSeek and Qwen directly through their native API endpoints.

Hunt.io, publishing on 14 July from an open directory it found at 112.213.124[.]132 on port 8888, describes the opposite arrangement: Claude Code 2.1.165 as the execution engine across persistent sessions between 8 and 12 June 2026, with DeepSeek-v4-pro underneath doing the reasoning, and a recovered CLAUDE.md file instructing Claude Code to create, test and iterate cloned phishing pages.

Both reports describe an agent framework left serving a directory on port 8888. They describe different victim sets: Hunt.io's confirmed intrusions are in Afghanistan, Thailand and Taiwan, with phishing staged against two United States government bodies; Unit 42's confirmed victims are three unnamed Citrix operators and a Malaysian government entity, with the autonomous probing aimed largely at Chinese domestic infrastructure. Neither report cross-references the other, and neither the archive nor either vendor has published a reconciliation. Read together they support one conclusion, not two: LLM-driven intrusion work was running inside this operator's environment in June and July 2026. Which model sat where in the stack — and whether the two reports describe one operator or two — is not settled by the published record.

What changed after

Because the exposure produced the evidence, the most concrete change concerns the actor rather than the victims. Unit 42 says it shared the findings with Cyber Threat Alliance members, and its page carries an 11 August 2026 update stamp, twelve days after publication. For Palo Alto customers it lists Cortex Xpanse attack-surface rules for exposed Langflow, n8n and Citrix ADC appliances, plus a set of Threat Prevention signatures.

On the vulnerable products, the fixes predate the campaign. n8n shipped 1.120.4 and 1.121.0 for the two flaws before the recovered session, and the agent read those version boundaries off the advisories itself. CSA's 4 August note recommends that NetScaler operators exposed to CVE-2026-3055 rotate NSC_AAAC session-authentication cookies and review authenticated sessions for anomalies, since the actor was explicitly hunting that cookie, and that anyone with suspected exposure to the Marimo flaw assume command execution may already have occurred.

CISA's Known Exploited Vulnerabilities catalogue, read directly on 30 October 2026, shows how public this material was before any of it was reported: CVE-2025-68613 was added on 11 March 2026, CVE-2026-33017 on 25 March, CVE-2026-3055 on 30 March, CVE-2026-39987 on 23 April and CVE-2026-0300 on 6 May — all before Unit 42 published. CVE-2026-34486 followed on 4 August and CVE-2026-33824 on 18 August. CVE-2026-21858, the n8n file-read half of the failed autonomous chain, does not appear on the catalogue at all.

Why the margin is the finding

Unit 42's conclusion is not that the campaign succeeded but that it nearly did. Exploitation was stopped by target-side configuration — the absent auto_login, the authenticated forms — and the report states that "targets with weaker default configurations would have been susceptible". Its overall judgement is that autonomous attack cycles are operationally viable and that the margin of failure was narrow.

CSA's independent reading points at the same asymmetry from a different angle: autonomous reconnaissance and triage scaled far more readily than autonomous exploitation, and the confirmed, weaponisable outcomes depended on human-directed work layered on top of the agent's reconnaissance. Both readings cover one operator's campaign. The record contains no claim that an autonomous loop has yet taken a system on its own.