On 30 July, Unit 42 published its findings on an operator going by the aliases knaithe and KnYuan, self-described as a binary security researcher running an automated vulnerability intelligence feed out of Zhuhai. What they were actually running, alongside that day job, was Hermes Agent - an open-source orchestration framework that took terminal access, Telegram-based command and control, and a custom skills system, and pointed all of it at DeepSeek as the reasoning engine underneath. The operator's own involvement, per Unit 42's writeup, could be reduced to a single instruction sent over Telegram. Everything downstream - deciding what to scan, which of seven vulnerabilities to try, how to weaponise each one - ran without a human in that loop.
Seven vulnerabilities, one asset-search engine, zero manual targeting
The target list itself is the interesting part. Hermes was customised with three skills: one for jailbreaking the underlying model when it balked at a request, one for custom WebSocket-based exploitation, and one wired to FOFA, a Chinese asset-search engine, for enumeration. Against that toolkit it ran seven CVEs spanning Langflow (CVSS 9.8), two separate n8n flaws (one a perfect 10.0), Citrix NetScaler (9.8), Apache Tomcat (7.5), Marimo notebooks (9.8) and Windows' IKE VPN implementation (9.8) - a spread across workflow automation platforms, notebook environments and network infrastructure that no single human operator would credibly research end to end in the time this campaign ran. Unit 42 counted attempts against more than 460 targets, with the agent independently enumerating 84 reachable Langflow instances and flagging 647,017 n8n instances globally as a reconnaissance target set. It exfiltrated data from three Citrix NetScaler systems and got command execution on eleven Marimo notebook instances before the operation surfaced.
Caught by its own mistake, not by defenders getting lucky
Here's the detail worth sitting with: none of this came from a security team spotting anomalous traffic or a victim reporting an intrusion. Unit 42 found the whole operation because Hermes Agent, mid-campaign, spun up an HTTP file server from its own home directory instead of an isolated staging location - and that server sat there, reachable, holding the operator's API keys, exploit scripts, target lists, shell history and the model's own attack logs. A human operator with any operational discipline doesn't leave their toolkit on an open port. An autonomous agent optimising for "complete the assigned task" apparently doesn't weigh that risk at all unless someone has explicitly told it to. Unit 42's own framing was blunt: the failures that stopped this campaign from doing more damage were "narrow," blocked mostly by target-side configuration requirements rather than any fundamental limit in the approach. The researchers' conclusion wasn't "this didn't really work." It was that autonomous AI-driven attack cycles are operationally viable now, and that at least one operator is building persistent offensive infrastructure around that fact rather than using AI as an occasional shortcut.
The overlap with this week's patch deadline isn't a coincidence worth ignoring
One of those seven CVEs, the Apache Tomcat EncryptInterceptor flaw, is also sitting on CISA's Known Exploited Vulnerabilities catalog as of this week, alongside a separate, unrelated Langflow remote-code-execution flaw and the N-able N-central authentication bypass we covered two days ago. Federal civilian agencies have until 7 August to patch all three. The Tomcat flaw's presence on both lists in the same week isn't a sign that CISA is reacting to Unit 42's report specifically - the KEV catalog tracks confirmed exploitation across many sources - but it is a useful, uncomfortable confirmation that the theoretical AI-agent-as-attacker scenario security vendors have been warning about for two years now has an actual, dated, named instance sitting in a threat intelligence report, targeting a flaw your patch queue may already have filed under "get to it eventually" because a 7.5 CVSS score reads as moderate next to a 9.8.
- Patch CVE-2026-34486 (Apache Tomcat EncryptInterceptor) and the two other flaws CISA added this week regardless of your internal severity ranking - confirmed exploitation, autonomous or not, should override a CVSS-only queue.
- Check whether your organisation runs Langflow, n8n, Marimo or Citrix NetScaler anywhere reachable from the internet, and cross-reference against the seven CVEs Unit 42 published, not just the ones that made a headline.
- Treat "AI-assisted attacker" as a capability to plan around now, not a future scenario - Unit 42's report describes a real operator running a real campaign against real infrastructure, not a red-team demonstration.
- Review outbound and lateral traffic monitoring with the assumption that reconnaissance-to-exploitation timing may compress from days to minutes when a model, not a person, is doing the enumeration.
- If you build or run agentic tooling internally, take the operational security lesson seriously in the other direction too - an agent that opens a file server in the wrong directory during an internal task can leak your own credentials just as easily.
The campaign that got caught is, almost by definition, the sloppy one. An operator careful enough to isolate Hermes Agent's staging environment properly wouldn't have handed researchers a look inside. That's the part of this story that should sit less comfortably than the seven-CVE target list does. If you want a second pair of eyes on whether your internet-facing footprint would survive an automated, round-the-clock scan of this kind, email sales@halfteck.com.