AI agents aren't just there to help.
It's also starting to be used on the attackers.
In July 2026, Palo Alto Networks' Unit 42 published a case of a Chinese-speaking threat actor using a Chinese AI “DeepSeek” as an inference engine to attempt a cyberattack with an autonomous agent.
When humans first gave purpose, AI autonomously proceeded from target exploration to exploit acquisition, attack attempt, and policy change.
This attempt itself failed a lot due to authentication and configuration, but it has attracted attention as an example that the attack mechanism itself has changed rather than a "one-off incident".
Forbes Japan and others have also reported this movement as an example of zero trust confronting agent-type AI.
What happened
The attackers are believed to be Chinese-speaking threat actors operating under names such as “knaithe” and “KnYuan.”
We used DeepSeek as the brain and the open source Hermes Agent as the execution base.
Hermes Agent is an autonomous AI agent platform that can supervise terminal operations and external tool execution, and it has been reported that the attacker did not give detailed instructions after giving the initial instructions in Telegram and so on.
In the May 2026 session that Unit42 restored, agents autonomously performed the following flow:
- Explore Exposed Servers on the Internet
- Obtain a publicly available proof-of-concept code
- Evaluate if the target is attackable
- If it doesn't work, switch to a different product/path
In other words, it is not a "chat AI waiting for instructions", but a move close to an "attack agent who manipulates his own hands to achieve the goal".
For example, after testing the vulnerability of Langflow, it was determined that the conditions were not met and it was "low-value", and there is also a record of turning to another product that is more widely used.
Why doesn't it end with a single shot?
The key point here is that the attack cycle is more automated than whether a particular vulnerability has been breached.
Unit 42 notes that the agent processed the analysis, which would have taken hundreds of hours to narrow down the target, in minutes.
Attackers are improving settings, adding custom skills, and developing proxy infrastructure, and the technical barrier to entry has been lowered.
In this case, it was confirmed that the attempts to Langflow and n8n failed without meeting the authentication and necessary configuration conditions.
However, if the setting was loose, it may have led to damage, and it can not be said that "I was able to protect it this time".
Once the attackers find a way to work, they can quickly deploy the same mechanism sideways to a large number of targets.
Moreover, because it does not depend on human work time or concentration, it is scary that it is easy to increase the number of attack attempts at night or on holidays.
Attackers themselves are at risk
What's interesting about this investigation is that the autonomous agent exposed the attacker's secrets.
Due to an operational error, it was reported that the API key, exploit code, target list, and attack log were visible from the outside.
Autonomous AIs put not only their targets, but also their operational environments, at risk if they have the authority to do so.
That's why it's a technology that involves uncontrollable risks not only for the defenders, but also for the attackers.
The same is true when deploying AI agents within an enterprise. Permissions that are too broad can expose or manipulate unintended information.
What companies can do now
There is no special magical countermeasure against this type of threat.
Rather, the more thorough the basics, the lower the success rate of autonomous attacks.
- Do not leave unnecessary screens or default settings for Internet publishing services
- Require authentication and don't easily enable public forms or automatic logins
- Vulnerabilities with public PoCs should be patched and configured early
- Minimize permissions and make designs time-bound and revocable
- Continue to monitor "post-certification behavior" with a zero-trust mindset
As mentioned in the Forbes commentary, zero trust is more than just “doorway verification”.
Because agent AI is essentially about how you use permissions after you pass authentication.
Even for small and medium-sized enterprises, just "inventory the list of public services" and "check whether there is authentication in the management screen" will greatly increase the initial defense.
Security Concepts in the Age of AI Agents
2026 is also the year that “AI that delegates work” such as ChatGPT Work, Claude Cowork, and Gemini Spark spread all at once.
The same technology flow is beginning to be used by attackers as an "attack agent who delegates work".
Incidents in previous OpenAI agent assessment environments have also shown that AI can take unexpected actions to achieve its objectives.
This DeepSeek/Hermes case shows that it is becoming operational even in real attack campaigns.
In the future, security must be designed not only on the premise of "attacks operated by humans", but also on the premise of "attacks that AI autonomously explores, tries, and transforms".
Recap
An autonomous agent attack using DeepSeek as an inference is not a one-off topic, but an event that indicates a structural change in the attack method.
Even without detailed instructions from humans, we are entering an era of progression from target exploration to attack attempts.
While many attempts have been made to authenticate or set up this time, the same mechanism may work on a larger scale and faster in the future.
Makoto Tejima emphasizes not only the introduction of AI functions, but also the design of secure systems, including the review of public settings, authority design, monitoring, and final checkpoints.
You can consult with us according to your purpose, such as security diagnosis of existing systems, authorization design when introducing AI agents, and hardening of public services.
