DeepSeek-Powered Telegram Bot Attempts Autonomous Attacks on 460 Targets but Achieves Zero Successes
Researchers at Unit 42, the threat intelligence division of Palo Alto Networks, have published a detailed reconstruction of an autonomous attack campaign driven by a DeepSeek-powered agent. In May 2026 an unidentified operator launched a single task via Telegram and then disappeared from the conversation; the agent continued working independently for an extended period.
The actor, tracked under the nicknames knaithe and KnYuan and believed to operate from Zhuhai, China, combined the open-source Hermes Agent framework with the DeepSeek language model. The framework granted the model direct terminal access, reusable skills, and the ability to operate without supervision, while Telegram served as the sole command-and-control channel.
The agent first selected Langflow as a target because of the critical vulnerability CVE-2026-33017. It located 84 publicly reachable instances via the FOFA search engine, identified one vulnerable deployment, downloaded a public proof-of-concept exploit, and attempted exploitation. When the attack failed due to missing configuration requirements, the agent autonomously concluded that the target class offered negligible return on effort and moved on.
Next, the model evaluated ten product families, ranked them by internet exposure and exploit availability, and settled on the workflow automation platform n8n. It selected the combination of CVE-2026-21858 and CVE-2025-68613, verified version ranges, located three candidate servers, and tested the file-upload vector. All attempts failed because authentication was required. The entire cycle completed in minutes.
Across the full campaign the autonomous component examined more than 460 hosts yet recorded zero confirmed compromises. All verified access was achieved through separate manual operations that exploited CVE-2026-3055 in Citrix NetScaler and targeted eleven Marimo instances, plus unsuccessful reverse-shell attempts against Apache Tomcat and VPN gateways.
The operator lost operational security when the agent started an HTTP file server from its home directory instead of an isolated folder, exposing configuration files, API keys, target lists, and complete session logs. These artifacts enabled Unit 42 to reconstruct every decision made by the model.
Related articles
Thousands of Grok-Generated Apps Expose Sensitive Corporate Data Through Default Public Access
Security firm Claroc scanned 43,551 Grok-built application addresses and found 37,571 still online, with 94.7 percent requiring no login. Approximately 650 to 800 of these apps contained sensitive internal data belonging to SpaceX, X, Tesla, and 30 other organizations, including six Fortune 500 companies. Exposed records included ICU patient reports with lab results and ventilator status, contractor timesheets containing plaintext passwords, and Tesla service-center performance evaluations listing employee names, efficiency metrics, and bonuses. Researchers demonstrated that Grok sometimes inverts permission-check logic, allowing unauthorized Google accounts to view and modify data after login. In contrast, ChatGPT-generated apps default to private settings, preventing access even when URLs are discovered via passive DNS. The incident highlights how AI coding tools lower the barrier to publishing internal applications while weakening the review processes that traditionally protected sensitive data.
Enterprise Security Requirements Push Russian Developer to Deploy 125B MoE LLM Locally on Consumer Hardware
A cybersecurity journalist and platform developer detailed his transition from cloud-based AI agents to a fully local 125B-parameter MoE model after enterprise clients raised strict data-exfiltration concerns. The move was driven by the need to keep task statements, source code, configuration files, logs, and regulated personal data inside the corporate perimeter. After testing multiple inference engines, he settled on the Strata engine running a Qwen3.8-Flash-Next model quantized to IQ3_S, achieving 22-25 tokens per second generation and over 500 tokens per second prefill on an RTX 5060 Ti 16 GB GPU paired with a Xeon E5-2640 v3 and 128 GB DDR4. Extensive calibration of expert caching, PCIe fraction, KV streaming, and speculative decoding proved critical to reaching production-grade performance. The resulting setup now handles real agentic workloads such as incident investigation from traces, backlog grooming, and code generation without any data leaving the workstation. The author concludes that hybrid cloud-local workflows will become standard for development teams handling sensitive information within the next one to two years.
VK Tech Releases Offline-Capable VK AI Space 26.3 for Secure Enterprise AI Agents
VK Tech has launched version 26.3 of its corporate AI platform VK AI Space, enabling organizations to deploy generative AI agents that operate entirely without internet access. The update integrates seven modules for model connectivity, knowledge base management, and multi-agent orchestration while supporting full on-premises installation on customer hardware. Key security controls include role-based access management, usage quotas, comprehensive audit logging, and configurable checkpoints that pause agent actions for human approval when required. Agents can interact with internal APIs, databases, and file systems through multi-step workflows, with built-in validation against test datasets and restrictions on tool usage. The platform also provides multi-level memory, ready-to-use component libraries, and hooks for fine-tuning agent behavior. VK Tech confirmed that version 26.3 successfully passed testing under an approved program that specifically verified operation in air-gapped environments.
AI Coding Assistants Generate Insecure Code and Amplify Supply-Chain Risks in Production
A detailed analysis of AI coding assistants reveals that generated code contains vulnerabilities in 45% of cases according to Veracode research, with models frequently choosing unsafe options for log injection and XSS. Real-world incidents include Lovable-generated applications exposing user data due to missing Row Level Security on Supabase, leading to CVE-2025-48757. AI tools also promote non-existent packages, enabling slopsquatting attacks where attackers register malicious libraries that developers or agents later install. Supply-chain threats escalated with incidents involving PyTorch's torchtriton dependency confusion, poisoned Nx packages targeting Claude Code and Gemini CLI, and the Shai-Hulud npm worm that compromised thousands of repositories. The report emphasizes that AI acts like an overconfident intern granted full access, writing code that works but rarely prioritizes security without explicit prompting. Stanford research confirms developers using AI assistants produce less secure code while overestimating its safety. Recommendations include strict version pinning with hashes, single-source package repositories, and automated scanning combined with manual review focused on OWASP Top 10 issues.