Attacker used DeepSeek to steal 5,200 Indian university records
Unit 42 says a weak administrator password, not a new software flaw, exposed the MongoDB holding student and staff data.
62
Product
Hermes Agent
- Mentions · 7d0
- Mentions · 30d4
- All mentions14
- First seenSep 2, 2026
- Last mentioned17d ago
Timeline
14 articles · newest firstUnit 42: BUGSTER used DeepSeek V4 in India university data theft
The actor brute-forced a site and stole more than 5,200 student and faculty PII records, Unit 42 says.
64
BUGSTER used jailbroken AI to hit Indian universities, Unit 42 says
The actor dumped more than 5,200 student records and planned VoIP fraud, Wi-Fi cracking, and crypto reconnaissance.
72
Learning to use local AI is exciting, overwhelming, and frustrating
Verge tester runs 125B Qwen locally via Hermes Agent on a 256GB Mac Studio.
18
Here are the top AI agents that can live in your text messages
TechCrunch lists text-message AI agents, including Instinct, valued at $10 billion after a $1 billion round.
32
Carbonato Botnet Puts an AI Agent on Hacked Docker Hosts
Carbonato installs Hermes Agent on hacked Docker hosts to run Telegram commands and steal AI API keys.
64
Carbonato Botnet Compromises Docker Hosts to Deploy Telegram-Controlled Hermes AI Agent
Carbonato botnet infects unauthenticated Docker hosts and installs a Telegram-controlled Hermes AI agent to steal credentials and run commands.
74
Hackers Turn an Open-Source AI Agent Into a Tool for Controlling Compromised Docker Servers
CARBONATO botnet hijacks exposed Docker servers and uses Hermes Agent for operator control.
74
Researchers Found a Botnet That Uses an AI Agent to Operate Inside Compromised Servers
CARBONATO infects exposed Docker hosts, persists, spreads to nearby daemons, and runs a Telegram-controlled AI agent.
74
AI-Powered CARBONATO Botnet Steals Credentials to Fund Its Own LLM Gateway
CARBONATO hijacks exposed Docker hosts, installs an AI agent, and steals LLM API keys to fund its gateway.
76
New Carbonato malware uses AI agents to hijack exposed Docker hosts
Carbonato botnet hijacks exposed Docker hosts, installs Hermes Agent, and spreads by scanning for more daemons.
76
Hackers Turn AI Agent Into a Cyber Weapon After Deleting Its Safety Refusals
Researchers exposed BlackHatSect0r && DXQRTXX infrastructure showing a safety-disabled Hermes AI agent used to automate scanning, credential harvesting, and vishing against French telecom subscribers.
60
Nous Research Adds One-Click Local Model Setup to Hermes Desktop
Nous Research's Hermes Desktop now offers one-click local model setup that reads hardware, picks a fitting quantization, downloads weights, and configures llama.cpp automatically.
25
Malicious .git Configs Can Make Claude, Codex, Cursor, and Other AI Agents Run Attacker Code
Malicious .git core.fsmonitor configs let attacker code run in AI coding agents like Claude Code and Codex; four of eight flaws remain unpatched.
68
Related CVEs
by mentions- CVE-2026-425306%9.2NGINX Open Source has a vulnerability in the ngx_http_v3_module module
- CVE-2026-71963<1%8.6Command injection RCE in Hermes Agent via malicious .git/config
- CVE-2022-24346<1%7.8In JetBrains IntelliJ IDEA before 2021.3.1, local code execution via RLO (Right-to-Left Override) characters was possible
- CVE-2021-4389113%7.8Visual Studio Code Remote Code Execution Vulnerability
- CVE-2026-55607<1%7.7Claude Code: Claude Code's worktree handling allowed creation of worktrees named ".git" and navigation to worktrees outside the sandbox…
- CVE-2026-19592<1%7.3Unsandboxed attacker code execution in OpenAI Codex via malicious Git core.fsmonitor
- CVE-2026-72718<1%7.0goose is general-purpose AI agent that runs on your machine
Appears with
- Dockervendor · 6
- Dockerproduct · 6
- Carbonatomalware · 6
- ThreatDownorganization · 5
- Telegramproduct · 4
- Cursorproduct · 4
- Nous Researchorganization · 4
- Palo Alto Networksorganization · 3
- DeepSeek V4ai model · 3
- Unit 42organization · 3
- Nous Researchvendor · 3
- WordPressproduct · 2
- BUGSTERthreat actor · 2
- GitHubvendor · 1
- VulnCheckvendor · 1
- Asusvendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.