Unit 42 Report: Hackers Harness DeepSeek and Other LLMs for Autonomous Cyberattacks
cyb3rops · x · 2026-08-01
Palo Alto Networks' Unit 42 threat research team published a report detailing an AI-enabled autonomous hacking campaign by a Chinese-speaking threat actor.
- Tactics: The adversary leveraged the Hermes Agent framework with DeepSeek as an autonomous offensive operator. Orchestrated via Telegram, the AI independently enumerated targets using FOFA, sourced exploit tools, and initiated attacks.
- LLM Abuse: Alongside DeepSeek, the actor configured multiple Chinese LLMs (Qwen, GLM, Kimi, MiniMax). Limited testing of Western tools like Claude Code and Codex was also noted for proxy validation and exploit development.
- Impact: Targeting seven distinct vulnerabilities, the campaign combined AI-driven enumeration with manual exploitation, achieving confirmed impact on infrastructure.
More from coding & agent
- Four Gemini 4 Argon agents beat Minecraft's Ender Dragon in 27 hours with 2,783 self-written programs — robertarail · 2026-10-16
- Dev builds oddly satisfying self-fixing sand component that repairs itself — prasenx · 2026-10-16
- When Does an Agent Actually Need an API Gateway? Reddit Weighs Direct Calls vs. Unified Endpoints — TurbulentStiffness · 2026-10-16
- optimAIzr: Open-Source Local CLI Tracks Where Your Claude Code and Codex Tokens Go — stichstichstich · 2026-10-16
- Local tool calling compared: how Gemma 4, Llama 3 and Mistral differ — leslysandra · 2026-10-16
- Harness, a command center for coding agents, hits #2 on Product Hunt — dee_hw · 2026-10-16