NewsPublished 31 Jul 2026

Hacker uses DeepSeek AI to autonomously attack vulnerable servers

Source Bleeping Computer

Mentions 4 CVEs

Mentioned vulnerabilities

Description

A Chinese-speaking threat actor is using the DeepSeek AI model and the open-source Hermes Agent to conduct autonomous cyberattacks on exposed servers with limited human involvement. [...]

Impact

The autonomous AI attack workflow accelerates the reconnaissance and exploitation phases of cyberattacks, enabling rapid identification and targeting of vulnerable systems. While the autonomous attacks observed did not result in successful compromises, the actor's manual attacks achieved confirmed breaches, including session hijacking via Citrix NetScaler vulnerabilities. This demonstrates the potential for AI-driven tools to enhance attacker efficiency and scale, increasing the risk of rapid exploitation of newly discovered vulnerabilities.

Defensive guidance

Security teams should monitor for exploitation attempts targeting these vulnerabilities and apply official patches or mitigations as they become available. Given the autonomous nature of the attacks, organizations should prioritize timely vulnerability management and exposure reduction of internet-facing services. No vendor advisory content was provided indicating no action is required or that the issue is already mitigated.

Summary

The threat actor leverages DeepSeek as the reasoning engine behind Hermes Agent, an AI framework capable of executing OS commands and internet interactions autonomously. Hermes was configured to operate in a 'Yolo' mode, executing commands without operator approval, and integrated with the FOFA internet asset search engine to identify exposed servers. The agent autonomously scanned for vulnerabilities such as CVE-2026-33017 in Langflow servers and a chained exploit involving CVE-2026-21858 and CVE-2025-68613 targeting the n8n platform. Despite extensive autonomous attempts, no successful compromises were observed from these AI-driven attacks. However, manual attacks by the actor exploited vulnerabilities including CVE-2026-3055 in Citrix NetScaler, resulting in at least three confirmed compromises. The campaign highlights an AI-driven workflow capable of rapid target identification, exploit selection, and attack execution, significantly reducing the time required for manual analysis.

References

bleepingcomputer.com/news/security/hacker-uses-deepseek-ai-to-autonomously-attack-vulnerable-servers/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 31 Jul 2026, 19:19 UTC

References

Community reviews

Related threats