Hackers let Chinese AI model work almost on its own

A Chinese-speaking hacker has used the Chinese AI model DeepSeek to have an AI agent carry out parts of cyberattacks. That is according to security firm Palo Alto Networks, through its research unit Unit 42, which published its analysis on July 30, 2026.

An AI agent is a program that can take a series of steps on its own to complete a task, without a human directing each step.

One actor and an agent controlled via Telegram

Unit 42 calls the actor knaithe or KnYuan. According to Unit 42, the person is based in Zhuhai, China, and describes themselves as a "binary security researcher."

The actor used DeepSeek as the main model in Hermes Agent, an open-source framework for AI agents. The framework was controlled through the messaging service Telegram. Other models such as Claude Code, Codex, Qwen, GLM, Kimi and MiniMax were only tested on a limited basis.

Unit 42 counts more than 460 targets for which exploitation was attempted in total. The autonomous campaigns hit a sample of about 100 of 25,209 Chinese n8n instances (n8n is a tool for automating workflows).

Unit 42 also found a session from May 7, 2026, in which the operator gave only an initial task, after which the agent kept working without human feedback.

Limited impact, but it works

The autonomous attempts to exploit vulnerabilities in Langflow and n8n failed. Unit 42 assesses that the workflow functions from end to end, but that the impact was limited and the margin for error was narrow.

Manual attacks, by contrast, hit victims in three countries and several sectors. Data was extracted from three organizations via a vulnerability in Citrix NetScaler. On 11 endpoints, command execution was confirmed via a vulnerability in Marimo Notebook.

State-backed groups are using AI too

A separate study comes from the Taiwanese security firm TeamT5. According to the firm, state-backed Chinese groups have more than doubled their attacks after they began handing routine tasks over to AI, including the development of malware.

TeamT5 names the groups Grimfengxi, which developed exploit code with DeepSeek, Huapi, which attacked an email system, and Teleboyi, which mapped about 1,000 IP addresses. The group Slime22 used Anthropic's Claude. Activity linked to one of the groups overlaps with Mustang Panda.

TeamT5 also says that a startup with about 10 employees sells hacking tools for 300,000-500,000 yuan, or about USD 44,500-74,000, per package. At least four hacker groups are customers.

TeamT5's chief analyst Charles Li says DeepSeek is the AI that Chinese hackers choose because it is relatively powerful and has very weak safety guardrails.

DeepSeek and Chinese authorities declined to comment.