DeepSeek Used in Hermes Agent Operation Against More Than 460 Targets

Palo Alto Networks' Unit 42 says a Chinese-speaking threat actor used DeepSeek through the open-source Hermes Agent framework in a campaign of autonomous and conventional exploitation attempts against more than 460 targets. The operator gave one Telegram instruction; researchers recovered no further input in the session. Seven tracks spanned eight CVEs.

What the autonomous agent did

DeepSeek was the primary reasoning model in Hermes Agent, which supplied terminal access and unattended execution. It checked versions, fetched exploits, abandoned one route and chose a new flaw based on severity, scale and apparent exploitability.

In a recovered May 2026 session, DeepSeek fetched an exploit for Langflow flaw CVE-2026-33017, enumerated 84 instances through FOFA and found one target on version 1.3.4. It stopped because auto_login was not enabled and no public flow identifier was usable.

It then reviewed 10 product families and selected n8n. FOFA returned 25,209 n8n systems in China; DeepSeek sampled about 100, probed roughly 40 and found three with vulnerable versions. One target's three form endpoints required authentication, and more than 50 others lacked a usable public form, so no n8n system was compromised.

Impact, exposure and fixes

Separate manual activity reportedly exfiltrated data from three organizations through NetScaler flaw CVE-2026-3055 and executed commands on 11 Marimo instances through CVE-2026-39987. The report later said only three targets were confirmed exploited across the entire operation, but did not reconcile the statements.

Langflow fixed CVE-2026-33017 in 1.9.0, and Marimo fixed CVE-2026-39987 in 0.23.0. n8n addressed CVE-2026-21858 in 1.121.0 and CVE-2025-68613 in 1.120.4, 1.121.1 and 1.122.0, making 1.121.1 the earliest release covering both. Citrix says CVE-2026-3055 affects customer-managed NetScaler ADC and Gateway appliances configured as SAML identity providers.

Hermes Agent exposed the operation by starting an HTTP server from /home/worker on port 8888, making API keys, exploit scripts and session logs accessible. Businesses should patch the affected products and remove unnecessary public access to workflow and notebook interfaces.