Palo Alto Networks’ threat intelligence team, Unit 42, has published a report on what they describe as the first confirmed case of a threat actor weaponising a commercial AI model to run autonomous, multi-stage cyberattacks at scale. A Chinese-speaking operator — tracked under the handles knaithe and KnYuan, and assessed to be based in Zhuhai, China — used an open-source framework called Hermes Agent, powered by DeepSeek, to target more than 460 internet-facing systems. After a single instruction sent over Telegram in May 2026, the agent operated on its own: scanning for vulnerable hosts, downloading public exploits, abandoning dead ends, and selecting new targets based on CVSS score, deployment scale, and apparent exploitability — all without further operator input.
The agent worked through seven exploit tracks spanning eight CVEs. It attempted attacks on Langflow (CVE-2026-33017), n8n workflow automation (CVE-2026-21858 chained with CVE-2025-68613), and Marimo notebook servers (CVE-2026-39987). Both Langflow and n8n attempts failed because the targeted systems lacked specific configuration requirements the exploits depended on. In separate, manually-directed operations, the same actor exfiltrated data from three organisations using a NetScaler memory-overread flaw (CVE-2026-3055) and achieved command execution on 11 Marimo instances. Unit 42 also found signs that Claude Code and Qwen Code were used in parts of the operation, alongside evidence of Codex use in exploit-development directories.
How to check if you’re affected
Affected versions of each product have available patches. Check whether your organisation runs any of these:
- Langflow: affected versions before 1.9.0 — patch to 1.9.0 or later (fixes CVE-2026-33017)
- n8n: affected versions before 1.121.1 — patch to 1.121.1 or later (fixes both CVE-2026-21858 and CVE-2025-68613)
- Marimo: affected versions before 0.23.0 — patch to 0.23.0 or later (fixes CVE-2026-39987)
- NetScaler ADC / Gateway: affected models configured as SAML identity providers — check your appliance config for
add authentication samlIdPProfileand apply the builds listed in Citrix’s security bulletin for CVE-2026-3055
Also review whether any of these interfaces are unnecessarily exposed to the public internet. Workflow and notebook UIs (n8n, Langflow, Marimo) should not be accessible without authentication from public addresses.