Palo Alto Networks' Unit 42 reported a Chinese-speaking threat actor using the DeepSeek AI model for autonomous cyberattacks on July 31, 2026. The attacker utilized the open-source Hermes Agent framework to find and exploit system vulnerabilities. This operation required minimal human intervention to target internet-facing systems.
The threat actor, identified by the aliases knaithe and KnYuan, launched exploitation attempts against more than 460 targets. While configuration issues caused some specific platform attacks to fail, the campaign demonstrates the rise of automated hacking. Palo Alto Networks emphasizes that these developments necessitate advanced, AI-driven defensive security solutions.