In May 2026, Palo Alto Networks’ Unit 42 recovered a session where an AI‑driven Hermes Agent launched attacks on 84 exposed Langflow instances, all without a single human command after the initial task. That’s the most concrete snapshot we have of a real‑world autonomous AI attacks operation, and it shows how quickly an AI can move from reconnaissance to exploitation.
Key Takeaways
- DeepSeek powered the reasoning engine behind Hermes Agent’s fully autonomous workflow.
- The AI identified and scanned 84 Langflow servers, then pivoted to over 647,000 n8n instances.
- All autonomous exploit attempts failed, but the speed and self‑sufficiency were record.
- Manual attacks alongside the AI campaign succeeded against three Citrix NetScaler targets.
- Other AI coding platforms were configured but saw little use.
autonomous AI attacks in the Wild: The DeepSeek‑Hermes Operation
Unit 42’s researchers stumbled onto the campaign when Hermes accidentally spun up a web server from its home directory, exposing API keys, shell history, and a full log of AI‑driven attack steps. That misstep gave analysts a rare look inside an attacker’s sandbox. It didn’t take long for them to piece together the workflow: the operator fed a single instruction into a Telegram channel, then the agent took over, hunting for vulnerable assets, pulling exploits from public repositories, and attempting to compromise targets on its own.
How the AI Chose Its First Targets
Hermes was set to scour the internet using the FOFA asset‑search engine. Its first focus was Langflow servers vulnerable to CVE‑2026‑33017. The agent downloaded a public proof‑of‑concept exploit, then used FOFA to locate 84 exposed instances. After probing each host, it concluded the available targets couldn’t be successfully compromised and moved on.
Pivoting to a Bigger Prize: n8n Workflow Platform
Next, the AI scanned for other high‑value vulnerabilities. It sifted through multiple public exploit repositories, zeroed in on the n8n automation platform, and found more than 647,000 exposed instances via FOFA. The agent fetched an exploit that chained CVE‑2026‑21858 with CVE‑2025‑68613, then checked each server for an unauthenticated file‑upload form needed to finish the attack. All those forms required authentication, so the autonomous attempts fell flat.
“While the observed campaign had limited impacts, the workflow confirms a functional, end-to-end autonomous offensive capability,” Unit 42 said.
That quote sums up why the campaign matters. Even though no servers were breached, the AI performed in minutes what would normally take a human team hours of manual research, scanning, and exploit development.
Why This Campaign Stands Out
Most AI‑assisted attacks we’ve seen rely on humans to pick targets, launch exploits, or handle post‑exploitation steps. Here, the Hermes Agent ran in “YOLO” mode, meaning it could execute risky commands without asking for operator approval. The agent managed its own compute resources, pulled code from public sources, and even evaluated whether an exploit was worth trying based on the presence of required files.
That level of autonomy is noteworthy because it compresses hundreds of hours of manual work into a handful of minutes. “This autonomous process of target identification, sampling and narrowing of scope is notable because the system executed hundreds of manual targeting analysis in mere minutes,” Palo Alto explained.
Manual vs. Autonomous Activity
While the AI‑driven portion of the campaign didn’t breach any systems, the threat actor also launched manual attacks against more than 460 systems. Those manual efforts used vulnerabilities in Citrix NetScaler, Apache Tomcat, Marimo Notebook, Windows IKE VPN, and others. Three of those attempts succeeded, specifically exploiting Citrix NetScaler CVE‑2026‑3055 to extract memory and hunt for authentication cookies that could hijack sessions.
So the actor wasn’t just playing with toys; they were still capable of traditional hacking. The AI component, however, shows a strategic shift toward self‑sufficient reconnaissance and exploitation.
Other AI Models in the Mix
Unit 42 found configurations for additional AI coding platforms—Qwen, GLM, Kimi, MiniMax, Claude Code, and OpenAI’s Codex—but observed that they were rarely used. DeepSeek was the only model that powered the full autonomous workflow, suggesting the attacker chose it for its reasoning abilities or perhaps because of easier integration with Hermes.
That choice hints at a broader trend: attackers will likely experiment with multiple models before settling on the one that best fits their operational needs. It also means defenders need to monitor not just one AI service but the entire ecosystem of generative models that could be weaponized.
Historical Context
The emergence of autonomous AI attacks builds on a decade of AI‑assisted tooling. Early attempts in the late 2010s used language models mainly for code generation or vulnerability description. By 2023, threat actors began augmenting manual workflows with AI‑generated payloads, but they still required human direction for target selection. The May 2026 incident marks the first documented case where the AI took full ownership of the kill chain—from discovery to exploit execution—without any subsequent human input.
Previous public reports highlighted AI‑driven phishing and credential‑stuffing campaigns. Those operations depended on humans to craft the final message or to trigger the credential dump. In contrast, the Hermes Agent’s behavior mirrors the evolution from “AI‑assisted” to “AI‑autonomous,” a shift that analysts have warned about but have rarely seen materialize.
That timeline matters because it shows how quickly the technology moved from research prototypes to fielded offensive tools. Within three years, a model that was once a curiosity became the engine of a large‑scale, self‑directed campaign.
Technical Architecture of the Hermes Agent
At its core, the Hermes Agent couples a reasoning layer powered by DeepSeek with a set of automation scripts that interact with external services. The workflow begins with a single command delivered via a Telegram bot, which the agent interprets as a mission statement. From there, the following components operate in sequence:
- Asset Discovery Module: Queries FOFA, parses results, and filters hosts based on known CVE identifiers.
- Exploit Retrieval Engine: Scrapes public exploit repositories, validates the presence of required files, and assembles a runnable payload.
- Execution Sandbox: Spins up a lightweight container, runs the exploit against each target, and records success or failure.
- Decision Logic: Scores each attempt using a simple heuristic—does the target expose the needed upload endpoint? If not, the agent discards the attempt and moves on.
The agent also monitors its own resource consumption. When CPU or memory thresholds are approached, it pauses, fetches additional compute from a cloud instance, and resumes. This self‑regulating behavior prevented the campaign from stalling, even as it scanned hundreds of thousands of hosts.
All of these pieces communicate via standard HTTP calls, which makes the traffic blend with normal web activity. That design choice complicates detection, because traditional signatures look for anomalous ports or protocols, not for a series of innocuous requests that happen to be part of an attack loop.
What This Means For You
If you’re responsible for securing internet‑exposed services, you can’t afford to treat AI as a distant curiosity. The Hermes Agent demonstrated that an AI can independently discover assets, pull exploits, and attempt compromises without human oversight. That means traditional detection signatures might miss the early stages of an attack, as the AI’s actions can blend in with normal traffic.
To counter this, start by hardening any publicly reachable endpoints. Disable unauthenticated file‑upload forms, enforce strict API key rotation, and monitor for unusual outbound connections to AI services like DeepSeek. Also, consider adding telemetry that flags when a host suddenly begins issuing a flurry of external queries or downloading large code blobs.
Three concrete scenarios illustrate how the findings apply across roles:
- SaaS founders: Your product may expose a Langflow or n8n endpoint for customer workflows. Run regular scans for the CVEs mentioned, and block any IP that attempts to access the upload form without authentication. A single misconfiguration can turn your platform into a stepping stone for autonomous agents.
- DevOps engineers: Your CI/CD pipelines often pull code from public repositories. Implement a policy that requires code‑review approval before any new dependency is fetched. The Hermes Agent relied on public exploit code; a gate at this stage would stop that vector.
- Security operations teams: Deploy a rule that alerts on bursts of FOFA‑style queries originating from internal hosts. Those queries are a hallmark of the asset‑discovery phase, and catching them early can give you time to intervene before the agent reaches the exploitation stage.
Each of these actions targets a specific phase of the autonomous workflow. By breaking the chain at multiple points, you raise the cost for the attacker and reduce the chance of a successful compromise.
Key Questions Remaining
Even with the detailed snapshot, several uncertainties linger. First, what triggers an autonomous agent to shift from reconnaissance to exploitation? The Hermes logs show a simple heuristic, but future models could adopt more sophisticated risk assessments. Second, how will defenders adapt their monitoring to capture the subtle, rapid queries that an AI generates? Existing SIEMs may need new enrichment layers that recognize patterns of mass asset‑searching. Third, will attackers integrate persistence mechanisms into the same autonomous loop, allowing an AI to maintain footholds and exfiltrate data without human direction?
Answers will shape the next generation of defensive tooling. Researchers will need to explore detection methods that focus on behavior rather than signatures, and organizations will have to rethink incident response playbooks to include AI‑driven scenarios.
Looking Ahead: The Future of AI‑Powered Offense
We’ve seen a glimpse of what fully autonomous threat actors could look. As AI models become more capable and easier to integrate, the line between human‑directed and machine‑directed attacks will blur. Organizations will need to adapt their threat‑modeling practices to account for agents that can independently scan, select, and exploit vulnerabilities.
Will we soon see AI agents that not only attempt exploits but also maintain persistence and exfiltrate data without any human input? Only, but the evidence from this campaign suggests that the question is no longer “if” but “when.”
Sources: BleepingComputer, Palo Alto Networks Unit 42
