AI Runs the Hack: Chinese Actor Automates Cyberattacks With DeepSeek
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2026-3055 | Out-of-Bounds Read in Citrix NetScaler ADC and Gateway When Used as SAML IDP CVE-2026-3055 is an out-of-bounds read (CWE-125) in Citrix NetScaler ADC and NetScaler Gateway caused by insufficient input validation when the appliance is configured as a SAML Identity Provider (IDP). An unauthenticated remote attacker can trigger the flaw by sending crafted input to the SAML IDP functionality, causing the appliance to read beyond the bounds of allocated memory and potentially disclose sensitive information from it. The CVSS 4.0 base score of 9.3 (critical) reflects a network-vector flaw requiring no privileges or user interaction. Only organizations running NetScaler ADC or NetScaler Gateway appliances with SAML IDP configured are affected, according to the available data. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2026-03-30, carries an 87.2% EPSS probability of exploitation within 30 days, has a public proof-of-concept, and headlines indicate active reconnaissance and exploitation against NetScaler deployments, including federal patch directives. Do: Apply the patched NetScaler ADC and NetScaler Gateway releases from Citrix's advisory as soon as possible, prioritizing internet-facing appliances (exact fixed version numbers are not in this data; check the vendor bulletin). Determine whether SAML IDP is configured on your appliances and, if it is not needed, disable or unbind it as an interim mitigation while reviewing appliance logs for suspicious authentication or reconnaissance traffic. Federal agencies must follow the CISA required action and BOD 22-01 guidance, with CISA directing patching by the stated Thursday deadline. | 9.3 | 87% | KEV PoC |
| largetens of thousands of internet-exposed NetScaler ADC/Gateway appliances, with the directly exposed subset limited to those configured as SAML IDPs | |
| CVE-2026-33017 | Unauthenticated RCE in Langflow AI Workflow Builder CVE-2026-33017 is an unauthenticated remote code execution flaw in Langflow, an open-source tool for building and deploying AI-powered agents and workflows. The POST /api/v1/build_public_tmp/{flow_id}/flow endpoint, which by design requires no authentication for building public flows, accepts an optional data parameter; when present, attacker-controlled flow data — including arbitrary Python code embedded in node definitions — is used instead of the flow stored in the database and passed to exec() with no sandboxing. An attacker who can reach this endpoint on an affected instance can therefore execute arbitrary Python code without any credentials, typically yielding full compromise of the underlying server. All Langflow versions prior to 1.9.0 are affected; the issue was fixed in 1.9.0 and is distinct from CVE-2025-3248, which only added authentication to the /api/v1/validate/code endpoint. The flaw was added to CISA's KEV catalog on 2026-03-25 (confirming exploitation in the wild), carries a 96.2% EPSS probability of exploitation within 30 days, and related reporting describes Langflow RCE attacks, including ransomware activity targeting AI model files. Do: Upgrade all Langflow deployments to 1.9.0 or later. If immediate patching is not possible, keep Langflow off direct internet exposure (place it behind an authenticating reverse proxy or firewall) and review logs for unauthenticated POST requests to /api/v1/build_public_tmp/{flow_id}/flow that include a data parameter, which would indicate exploitation attempts. As a KEV entry, federal agencies must apply mitigations per vendor guidance and BOD 22-01, or discontinue use of the product if mitigations are unavailable. | 9.3 | 96% | KEV PoC ×4 |
| moderateon the order of several thousand internet-exposed Langflow instances (estimate) | |
| CVE-2026-39987 | Unauthenticated Remote Code Execution in Marimo Python Notebook Marimo, a reactive Python notebook, contains an unauthenticated remote code execution flaw (CVE-2026-39987, CWE-306; CVSS 4.0: 9.3 Critical) because its terminal WebSocket endpoint /terminal/ws skips authentication entirely. Unlike other WebSocket endpoints such as /ws, which call validate_auth(), /terminal/ws only checks the running mode and platform support before accepting connections, so any unauthenticated attacker who can reach the server can obtain a full PTY shell and execute arbitrary system commands on the host. All marimo deployments running versions prior to 0.23.0 are affected, with internet-exposed instances at greatest risk. Exploitation is confirmed in the wild: the flaw was added to CISA's KEV catalog on 2026-04-23, public PoCs exist, and reporting shows it was exploited within roughly 10 hours of disclosure, with observed post-exploitation activity involving LLM agents. EPSS assigns a 98.9% probability of exploitation within 30 days (100th percentile). Do: Upgrade marimo to 0.23.0 or later; until patched, restrict access to the /terminal/ws WebSocket endpoint by binding the notebook to localhost, a VPN, or an authenticating reverse proxy. Identify whether any marimo instances are internet-exposed and review logs for connections to /terminal/ws and unexpected shell or process spawns, given reports of LLM-agent-driven post-exploitation on compromised instances. As a KEV entry (added 2026-04-23), this requires federal agencies to apply the vendor fix or mitigations per BOD 22-01 timelines. | 9.3 | 99% | KEV PoC ×4 |
| moderatelikely tens of thousands of users, with directly internet-exposed marimo servers plausibly in the low thousands |
Full article1,064 words · extracted from securityaffairs.com · click to collapse
Unit 42 uncovered an AI-driven Chinese hacking campaign where DeepSeek autonomously scanned targets, selected exploits, and launched attacks.
Researchers at Palo Alto’s Unit 42 got a front-row seat to something they’d only theorized about before: an AI system running an actual hacking campaign with almost no human steering it. The researchers spotted a Chinese-speaking actor, going by the handles knaithe and KnYuan, who wired DeepSeek into an open-source framework called Hermes Agent and let it hunt for vulnerable targets, find exploit code, and launch attacks on its own.
The researchers only saw any of this because the attacker made one careless mistake.
That mistake was starting a file server in the operation’s home directory instead of an isolated staging folder. It exposed everything: API keys, exploit scripts, target lists, bash history, and full session logs of the AI actually doing the work.
Unit 42 essentially got to watch the attacker’s screen after the fact.
DeepSeek wasn’t the only AI in play. The actor also tested Qwen, GLM, Kimi, and MiniMax, and even poked at two Western tools, Claude Code and Codex, though only in a limited, exploratory way. Claude Code got ten total interactions across three sessions, mostly connectivity checks; Codex’s actual use couldn’t be confirmed because the attacker had disabled its conversation logging.
“In parallel with their use of DeepSeek as their autonomous operator platform, the actor configured multiple large language models (LLMs) (Qwen, GLM, Kimi, MiniMax). We also identified limited usage and testing of Western platforms. This includes Claude Code for connectivity testing and proxy validation.” reads the report published by Unit 42. “There were also signs of usage of Codex on exploit development directories. This limited usage is consistent with evaluating the AI-market to identify their preferred tool set.”
The tool configuration says a lot about intent. Both Western tools got routed through a third-party proxy to hide the connection, with attribution headers stripped and non-essential traffic disabled. DeepSeek and Qwen, by contrast, connected straight to their native APIs with no such precautions, which tells you which tool the attacker actually trusted for the job.
“DeepSeek, operating through the Hermes Agent framework, served as the actor’s primary offensive AI tool. Hermes Agent provided orchestration (terminal access, Telegram-based command and control, and the skills system) while DeepSeek served as the reasoning engine for code generation, vulnerability assessment, target selection and decision-making.” continues the report.
“The actor had customized Hermes Agent with three red-teaming skills:
- fofa-cyberspace-search: a custom procedure template instructing DeepSeek to use the actor’s fofoapi.py script for internet asset enumeration”
- godmode: LLM jailbreaking, framework-bundled
- web-terminal-exploitation: unauthenticated WebSocket exploitation, custom-created”
Watching DeepSeek work through an actual attack chain is the most striking part of the report. It found a Langflow vulnerability (CVE-2026-33017), downloaded a public proof-of-concept, scanned for 84 live instances, and hit a wall: every target needed either a public flow ID or a login setting the attacker didn’t have access to. Rather than giving up, DeepSeek talked itself through the dead end and moved on, reasoning in real time that the deployment base was too small to bother with and it should look for something bigger.
That reasoning led it to n8n, a workflow automation tool with a proof-of-concept exploit that had racked up far more attention on GitHub than Langflow’s had. FOFA scans confirmed the instinct: over 647,000 n8n instances existed worldwide, more than 25,000 of them in China. DeepSeek chained two separate vulnerabilities together, worked out exactly which version range was exploitable, then ran headfirst into the same kind of wall as before, every accessible form endpoint it found required authentication it didn’t have.
The AI never fully broke in anywhere during these autonomous runs. But it sampled roughly 100 IP addresses out of that 25,000-plus n8n population, actively probed around 40 of them for version details, and found three vulnerable systems, compressing what Unit 42 says would normally take a human hours to do into a handful of minutes. “the system executed hundreds of hours of manual targeting analysis in mere minutes”, and that’s the number that should worry defenders more than any single failed exploit.
“While most of the systems were unreachable or non-responsive, DeepSeek found three with the vulnerable versions and attempted to exploit them automatically. This autonomous process of target identification, sampling and narrowing of scope is notable because the system executed hundreds of hours of manual targeting analysis in mere minutes, while also managing its own compute resources.” continues the report. “Across all the exploitation attempts, both autonomous and manual, Unit 42 confirmed data exfiltration from three Citrix NetScaler targets (CVE-2026-3055) and command execution on 11 Marimo notebook endpoints (CVE-2026-39987). “
While the AI chased those two failures, the same actor was busy elsewhere doing old-fashioned manual hacking that actually worked. They pulled data out of three organizations through a Citrix NetScaler flaw, got command execution running on eleven Marimo notebook instances, and attempted reverse shells against Apache Tomcat servers and Windows IKE VPN endpoints. One target, a government body in Malaysia, got hit repeatedly over multiple days with increasingly careful technique and proxy anonymization layered in on later attempts, a level of patience the fully-automated runs never showed.
Unit 42 traces the actor back to Zhuhai, China, partly through a side project on GitHub: an automated tool that scrapes seventeen sources for newly disclosed remote-code-execution bugs, uses DeepSeek to sort which ones are actually exploitable, and pushes alerts out over Telegram. That’s a hacker who’s already comfortable outsourcing judgment calls to a language model well before this campaign started.
Nothing here fully succeeded, and that’s exactly the point researchers are making. The only thing standing between working exploits and failed ones was target-side configuration that happened to be tighter than average, not any weakness in the attacker’s approach. Build your systems with the defaults this campaign got blocked by, because the AI running the offense clearly isn’t going to be the bottleneck for much longer.
“Our findings document a threat actor developing AI-augmented offensive capabilities that enabled them to dramatically increase the speed and scale of their campaigns.” concludes the report. “This research validates an emerging threat posed by AI-enabled attackers as they hone their autonomous attack processes to discover, assess, pivot and retarget without human intervention.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, AI)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/196544/ai/ai-runs-the-hack-chinese-actor-automates-cyberattacks-with-deepseek.html