Hackers Turn AI Agent Into a Cyber Weapon After Deleting Its Safety Refusals

A French-speaking cybercrime crew calling itself BlackHatSect0r && DXQRTXX allegedly disabled safety controls in a self-hosted AI agent and used the resulting system to automate mass credential harvesting, target discovery, phishing preparation, and attack orchestration.

The internet-exposed server reportedly contained 4.9 GB of material across 9,299 files, including a custom Go-based command-and-control platform named DXSCAN, a vault containing 16,834 harvested credentials, phishing infrastructure, extortion tooling, and operator shell history.

Researchers said the data was reviewed through static analysis, passive observation of the exposed panel, and public-source collection, without executing malware or logging into actor-controlled systems.

At the center of the operation was a Nous Research Hermes agent connected to a DeepSeek model.

The operator allegedly removed a “discernment retained” instruction from the agent’s memory and identity configuration, replaced it with language demanding unconditional execution, and set the HERMES_DISABLE_SAFETY=1 environment variable.

The agent was subsequently used as an operational layer for persistent scanning, secret hunting, Telegram reporting, and workflow automation.

The crew’s DXSCAN platform was exposed on port 8080 and reportedly used country-weighted IP generation, web-service fingerprinting, configuration-file scanning, credential validation, and Telegram notifications.

Its scanner contained more than 200 patterns for secrets in .env, YAML, JSON, PHP, and WordPress configuration files.

The operation allegedly queued 2.75 million domains, reached more than 726,000 hosts, and generated over 1.37 million IP addresses during its scanning activity.

The evidence suggests that BlackHatSect0r’s real capability depended less on novel exploitation than on security failures that remain widespread: public cloud buckets, exposed environment files, browser-shipped keys, and default signing secrets.

Researchers found that every confirmed compromise in the dataset followed one of those paths.

This distinction matters because it means organizations can substantially reduce exposure through routine configuration hygiene rather than preparing for unknown zero-days.

The most concerning downstream activity was an alleged vishing campaign targeting older French telecom subscribers.

The crew reportedly possessed a database of nearly 450,000 records containing identity data, phone numbers, subscriber details, and banking identifiers.

A tailored subset of 1,697 people aged 50 or older in Savoie and Haute-Savoie was paired with a Société Générale-themed fraud alert designed to make recipients call an attacker-controlled number.

By avoiding a malicious link or attachment, the lure could bypass many conventional email security controls.

The infrastructure also contained tools targeting public-sector and financial services. These included claimed activity against French institutions, an extortion portal naming New York public bodies, and JWT-forging tooling aimed at a cryptocurrency exchange that allegedly used the literal signing secret secret.

Socradar Researchers said that, the incident illustrates how agentic AI can amplify commodity cybercrime when operators deliberately remove refusal logic, secret redaction, and approval requirements.

AI Agent Into a Cyber Weapon

The researchers cautioned that public claims, particularly those involving named victims, should be treated separately from verified access evidence.

The actor’s exploit branding appears inflated. The toolkit included public and often old vulnerabilities, alongside misclassified CVEs and unfinished modules.

One relevant issue, CVE-2026-42530, is a real use-after-free flaw in NGINX HTTP/3’s QPACK handling that affects NGINX Open Source versions 1.31.0 through 1.31.1 when the HTTP/3 module is enabled; it was fixed in version 1.31.2.

Security teams should prioritize exposed-secret detection across internet-facing assets, especially public .env files, Git repositories, cloud object storage, CI/CD artifacts, and front-end JavaScript bundles.

Default JWT secrets, static cryptographic material, and client-side token-generation logic should be considered immediate remediation priorities.

Teams should also investigate unusual AI-agent artifacts on administrative or scanning hosts, including SOUL.md, .hermes/ directories, HERMES_DISABLE_SAFETY=1, and suspicious ghost_-prefixed processes.

These indicators may reveal locally deployed agentic frameworks adapted for offensive automation.

Organizations should rotate exposed credentials immediately rather than merely removing the file or repository containing them.

This includes cloud access keys, SMTP credentials, API tokens, database passwords, JWT signing material, OAuth secrets, and application encryption keys.

Internet-facing storage must be reviewed for anonymous read and write access, while environment files and configuration backups should be blocked from web access.

Development and pre-production systems should receive the same exposure management scrutiny as production because they often hold live credentials and copied datasets.

For NGINX deployments, organizations using HTTP/3 should verify patch status for CVE-2026-42530.

The vulnerability affects the HTTP/3 QUIC module, can trigger a worker-process restart, and may enable code execution in certain conditions; upgrading to NGINX Open Source 1.31.2 or later is the appropriate remediation path.

The BlackHatSect0r case underscores a broader operational reality: AI does not need to discover a zero-day to make cybercrime more dangerous.

When paired with exposed secrets, weak cloud configurations, automated scanning, and social engineering, an unrestricted agent can turn preventable security debt into a high-volume attack pipeline.

Indicators of Compromise

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC