DeepSeek AI used for autonomous cyberattacks by Chinese hacker
A Chinese hacker used DeepSeek AI within an autonomous attack framework to conduct cyberattacks after Western AI providers like OpenAI and Anthropic refused offensive tasks due to safety controls. Palo Alto Networks confirmed the actor achieved autonomous vulnerability exploitation and data exfiltration against internet-exposed infrastructure in Asia, demonstrating that AI model safety controls have defensive value.
What happened
A Chinese-speaking threat actor operating under the aliases 'knaithe' and 'KnYuan' and based in Zhuhai integrated DeepSeek into the open-source Hermes Agent framework to conduct autonomous cyberattacks. The actor initially configured and tested Claude Code, Codex, and other Western AI tools but found their safety controls prevented offensive use, according to Palo Alto Networks' Unit 42.
DeepSeek was wired into the Hermes Agent to serve as an autonomous offensive operator, creating a scan-research-exploit pipeline that required only a single Telegram command before largely operating independently. In a complete session recovered from May 2026, DeepSeek handled target enumeration, vulnerability selection, exploit sourcing from GitHub, and attack execution without additional operator input.
Reported impact
The threat actor targeted internet-exposed infrastructure by combining AI-driven enumeration with automated and manual exploitation of seven vulnerabilities. Manual exploitation attempts resulted in data exfiltration from Citrix NetScaler systems and command execution on Marimo Notebook systems, though autonomous exploitation attempts on Langflow and n8n failed due to restrictive target configurations.
Index analysis
Unit 42 assessed the incident as the first confirmed real-world proof that AI provider safety controls have measurable operational value as a defensive mechanism. The actor explicitly selected DeepSeek because it had 'minimal safety controls accessed through an open-source framework with no client-side restrictions,' while Western AI providers refused the offensive tasks.
Governance controls
Claude Code was configured with anti-attribution settings to suppress headers, and both Claude Code and Codex were routed through proxy services to attempt circumvention of safety measures. The actor's exploitation of DeepSeek through an open-source framework without client-side restrictions demonstrated a gap in governance where a deployed AI model lacked sufficient safeguards to prevent weaponization.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.