460 Targets, Zero Autonomous Hacks: How a Telegram Bot on DeepSeek Framed Its Owner

A malicious actor, operating under the nicknames knaithe and KnYuan, likely located in Zhuhai, China, combined the open-source agent framework Hermes Agent with DeepSeek to create an autonomous hacking system. The framework provided the language model with terminal access, reusable skills, and unsupervised operation, while Telegram served as the communication channel for task assignment and result retrieval. The agent initially targeted Langflow, a platform for building AI applications, exploiting CVE-2026-33017, but found only one vulnerable instance among 84 and abandoned it due to low success probability. It then pivoted to n8n, a workflow automation platform, with nearly 650,000 instances and two vulnerabilities, but failed to breach any due to authentication requirements. Over the campaign, the agent scanned and attempted attacks on 460 targets without a single confirmed success, while the operator's manual efforts yielded data exfiltration from three organizations via a Citrix NetScaler vulnerability and command execution on 11 Marimo instances. The operator's downfall came from the agent's own automation: when the agent started an HTTP server to share files, it exposed the entire home directory without a password, revealing configurations, API keys, scripts, and logs. Researchers noted that the agent's failures might stem from victim-side configurations rather than model limitations, and that DeepSeek was likely chosen because Western models like Claude and OpenAI refused autonomous attack requests due to provider-side restrictions. The report, while lacking definitive evidence for some conclusions, highlights the ease of entry into such operations and the urgent need for robust security defaults.