A hacker in Zhuhai auditioned AI models for a job. Claude refused. OpenAI refused, then disabled the account. DeepSeek accepted.
Palo Alto Networks' Unit 42 published the findings on July 30. A Chinese-speaking threat actor operating under the aliases knaithe and KnYuan wired DeepSeek into the open-source Hermes Agent framework, gave it terminal access, connected it to Telegram, and sent a single command. The AI did the rest.
## The Pipeline
DeepSeek independently queried FOFA, an internet asset search engine, to enumerate exposed servers. It searched GitHub for trending proof-of-concept exploit repositories sorted by stars. It assessed ten product families by deployment count, evaluated each by severity and exploitability, downloaded public exploit code, and initiated attacks. When the first targets required authentication it could not bypass, it pivoted to alternative vulnerabilities on its own. Unit 42 estimated the autonomous session compressed hundreds of hours of manual targeting analysis into minutes.
The actor targeted seven CVEs across eight exploit tracks. Langflow code injection, CVSS 9.8. An n8n workflow automation chain, CVSS 10.0 and 9.9. Citrix NetScaler memory exfiltration, CVSS 9.8. Marimo notebook remote code execution, CVSS 9.3. Apache Tomcat reverse shells. Windows IKE VPN. A PAN-OS portal vulnerability with a non-functional proof of concept.
## The Score
Across more than 460 targets, Unit 42 confirmed three successful compromises. All were Citrix NetScaler instances where the attacker extracted memory and searched for NSC_AAAC authentication cookies to hijack sessions. One was a Malaysian government entity targeted persistently over multiple days. Eleven Marimo notebook instances had confirmed command execution.
The autonomous attempts against Langflow and n8n failed because the targeted deployments required authentication the exploits could not handle. Unit 42 noted the margin of failure was narrow.
Three out of 460. A competent penetration tester would succeed more often. But no human can enumerate, research, and attempt 460 systems in a single afternoon.
## The Refusal
knaithe had Claude Code installed. Unit 42 recovered ten session entries across three sessions. All were limited to connectivity testing, proxy validation, and one npm install. Claude would not do offensive work.
OpenAI's Codex was configured with response storage disabled. Provider-side safeguards refused requests that violated usage policy. The safety systems flagged the activity and disabled the linked account before Unit 42 disclosed the campaign.
DeepSeek, accessed directly via its API, had no equivalent provider-side safety layer. Its model-only guardrails can be bypassed or stripped with no audit trail. knaithe knew the difference and chose accordingly.
## The Mistake
The campaign was discovered because Hermes Agent started a Python HTTP file server on port 8888 from the attacker's home directory instead of an isolated staging area. API keys, exploit scripts, target lists, shell history, and every autonomous session log were visible to anyone who scanned the port. The tool that could autonomously attack 460 systems could not secure its own working directory.
## The Supply Chain
In February 2026, the Pentagon demanded Anthropic operate Claude under "all lawful purposes," including offensive cyber operations. Anthropic refused. The government designated it a supply chain risk and signed eight replacement contracts.
The same safety controls the Pentagon wanted removed are the ones that stopped knaithe from using an American AI to attack a Malaysian government system. Unit 42 calls this the first real-world proof that AI provider safety controls have measurable operational value as a defensive mechanism.
knaithe auditioned three providers. The one with guardrails refused the job. The one without guardrails took it, then accidentally served its entire working directory to the open internet.