DeepSeek-Powered Telegram Bot Attempts Autonomous Attacks on 460 Targets but Achieves Zero Successes
Researchers at Unit 42, the threat intelligence division of Palo Alto Networks, have published a detailed reconstruction of an autonomous attack campaign driven by a DeepSeek-powered agent. In May 2026 an unidentified operator launched a single task via Telegram and then disappeared from the conversation; the agent continued working independently for an extended period.
The actor, tracked under the nicknames knaithe and KnYuan and believed to operate from Zhuhai, China, combined the open-source Hermes Agent framework with the DeepSeek language model. The framework granted the model direct terminal access, reusable skills, and the ability to operate without supervision, while Telegram served as the sole command-and-control channel.
The agent first selected Langflow as a target because of the critical vulnerability CVE-2026-33017. It located 84 publicly reachable instances via the FOFA search engine, identified one vulnerable deployment, downloaded a public proof-of-concept exploit, and attempted exploitation. When the attack failed due to missing configuration requirements, the agent autonomously concluded that the target class offered negligible return on effort and moved on.
Next, the model evaluated ten product families, ranked them by internet exposure and exploit availability, and settled on the workflow automation platform n8n. It selected the combination of CVE-2026-21858 and CVE-2025-68613, verified version ranges, located three candidate servers, and tested the file-upload vector. All attempts failed because authentication was required. The entire cycle completed in minutes.
Across the full campaign the autonomous component examined more than 460 hosts yet recorded zero confirmed compromises. All verified access was achieved through separate manual operations that exploited CVE-2026-3055 in Citrix NetScaler and targeted eleven Marimo instances, plus unsuccessful reverse-shell attempts against Apache Tomcat and VPN gateways.
The operator lost operational security when the agent started an HTTP file server from its home directory instead of an isolated folder, exposing configuration files, API keys, target lists, and complete session logs. These artifacts enabled Unit 42 to reconstruct every decision made by the model.
Related articles
Chinese Cybercriminals Deploy AI Agents to Automate Exploitation of Exposed Windows and Linux Servers
A Chinese cybercriminal group tracked as UAT-10147 is actively using AI agents to automate reconnaissance, exploitation, and post-exploitation against internet-facing Windows and Linux servers. Cisco Talos identified the campaign after discovering approximately 170,000 URLs in the attackers' infrastructure, with targets spanning government, education, media, technology, and gaming organizations across multiple countries including Brazil. The group divides targets into smaller batches to accelerate scanning and exploitation of known vulnerabilities in applications such as Zimbra, AjaxPro, Nacos, and Telerik. AI agents go beyond simple code generation by producing exploitation guides, refining failed attacks, verifying payload success, and automating persistence and post-exploitation steps. In one observed case, the agents created scripts capable of validating permissions, exploiting ViewState deserialization, installing implants, and deploying web shells on compromised IIS servers. Cisco Talos assesses the operation as a shift toward semi-autonomous offensive orchestration rather than basic AI-assisted scripting.
Hermes Emerges as Modular Harness for Practical AI Security Testing
The article details the development of Hermes, a lightweight modular harness designed to turn raw language models into reliable AI security agents. Unlike heavy frameworks such as OpenClaw, Hermes uses dynamic skill loading, strict runbooks stored in Git, and a file-system source of truth to eliminate hallucinations and context bloat. It continuously scans dozens of sources including NVD, CISA KEV, arXiv and research blogs, then applies the custom TIPS scoring metric to rank threats before attempting reproduction. A dedicated Paper-to-PoC skill converts academic attack descriptions into executable code that is validated inside an isolated Ollama and Docker sandbox. Eight mandatory validation gates must pass before any finding is accepted, ensuring reproducibility and freshness of data. The system already supports tools such as Garak, PyRIT, promptfoo, fickling, modelscan and presidio, and evolves autonomously by committing successful attack scenarios back to its repository.
Zero Trust for AI Agents: Why Separate Identity Alone Is Not Enough
Denis Korbakov, CTO of Smart-Soft, explains why traditional IAM approaches fail to secure autonomous AI agents that dynamically select tools, change context, and delegate authority. Only 21.9% of teams treat agents as distinct identity-bearing entities, while 45.6% rely on shared API keys and 44.4% use generic tokens. Research from Gravitee, Cloud Security Alliance, and Aembit shows that 68% of organizations cannot distinguish AI agent actions from human actions, 74% grant excessive privileges, and 52% allow rights inheritance. The article maps NIST SP 800-207 Zero Trust principles—explicit verification, least privilege, and assume breach—to agent workloads using short-lived scoped tokens, SPIFFE/SPIRE credentials, and layered policy enforcement points. A concrete ticket-diagnosis scenario illustrates how prompt injection can be contained through per-task authorization, dedicated network segments, and independent telemetry from NGFW and SIEM. The piece concludes with an open question on sub-agent delegation chains and offers reference OPA/Rego policies plus runbooks for pilot implementations.
AWS Details Architecture to Reduce Prompt Injection Risks in AI Agents
AWS has introduced a new architecture designed to prevent compromised or manipulated AI agents from accessing data beyond user permissions. The approach relies on Amazon Bedrock AgentCore to shift authorization decisions from the agent itself to the underlying infrastructure and connected services. The core risk arises when agents receive broad credentials to query databases, repositories, and SaaS platforms, allowing potential prompt injection attacks to retrieve unauthorized information. In the proposed design, users authenticate via Amazon Cognito and receive JWT tokens containing attributes such as department or role. The AgentCore Runtime validates these tokens before executing any agent actions, rejecting requests that violate configured rules. For DynamoDB queries, temporary credentials are issued through AssumeRoleWithWebIdentity, with IAM policies enforcing strict access to authorized data partitions only.