A China-linked threat actor has used DeepSeek, the Chinese AI platform, to autonomously search for critical vulnerabilities, identify proof-of-concept exploit code and launch attacks against government and financial systems according to Palo Alto Networks Unit 42. The campaign marks a documented shift from AI-assisted attack preparation to AI-directed execution during a live intrusion.
Unit 42 researchers traced the activity to an operator based in Zhuhai, China. Investigators recovered intrusion campaign data from 13 Hong Kong-based servers according to Security Affairs. The actor operated a toolchain built around Hermes Agent, an AI agent framework connected directly to a DeepSeek model, which autonomously conducted vulnerability enumeration without requiring manual direction at each step.
What Hermes Agent Actually Did
The workflow is specific enough to be worth unpacking. The actor instructed Hermes Agent to survey 10 product families for known critical-severity vulnerabilities. The agent queried DeepSeek for relevant CVEs, then independently searched GitHub for recent proof-of-concept repositories tied to those CVEs. It identified CVE-2026-21858 and targeted n8n and Langflow, two workflow automation platforms widely used in enterprise AI pipeline deployments.
The attack did not complete. Unit 42 notes the target environment’s restrictive configuration stopped the exploitation chain before it reached its objective. That is not reassurance. It means the approach works against environments that are less tightly configured and most are.
Unit 42’s summary of what this represents is direct, “Our findings document a threat actor developing AI-augmented offensive capabilities that enabled them to dramatically increase the speed and scale of their campaigns.” Speed and scale are the operative words. Vulnerability hunting and PoC discovery that previously took a skilled operator hours now runs autonomously in minutes.
The CVE Number Should Raise a Flag
CVE-2026-21858, the vulnerability the actor targeted, carries a 2026 prefix. The source data does not provide a CVSS score and NIST’s National Vulnerability Database does not yet carry a confirmed entry for this identifier at the time of writing. Unit 42’s report is the primary published source. Treat the severity characterisation as Unit 42’s assessment until a Tier 1 authority confirms it. The underlying behaviour, AI-directed autonomous exploitation of n8n and Langflow, is documented regardless of where this specific CVE lands in the scoring system.
n8n and Langflow are both open-source workflow automation tools that have seen rapid enterprise adoption as organisations build AI agent pipelines. They are not obscure research targets. They are production infrastructure in thousands of organisations including in Northern Europe.
Attribution Is Specific, But Treat It Accordingly
Unit 42 placed the operator in Zhuhai and linked the campaign to broader Chinese state-aligned activity patterns. The Hacker News reported the actor used Telegram to direct DeepSeek commands during the operation adding a layer of operational detail to the picture.
Palo Alto Networks has commercial reasons to publish threat research that makes AI-driven attacks sound imminent and severe. That does not mean the research is wrong. The infrastructure evidence, 13 identified servers, recovered campaign data, a documented toolchain, is more granular than most vendor disclosures. But until a government agency such as CISA, NCSC or ENISA issues a corroborating advisory, the Zhuhai-to-Beijing attribution chain should be read as an analytical assessment from a single commercial firm, not a confirmed state operation.
What Organisations Running n8n or Langflow Should Do Now
If your organisation runs n8n or Langflow in any internet-accessible configuration, check for updates and apply them immediately. Both platforms release security patches through their standard update channels. CVE-2026-21858 does not yet have a publicly confirmed patch status from the vendors at the time of writing, so monitor both projects’ GitHub security advisories directly.
Restrict external access to n8n and Langflow instances that do not require public exposure. Neither platform is designed to sit on the open internet without access controls. If your deployment uses default credentials or no authentication layer, that is the first thing to fix, before patching and independent of it.
The broader implication of this campaign is that vulnerability windows are narrowing. An AI agent scanning GitHub for proof-of-concept code does not wait for a security team’s next sprint cycle. Organisations still treating patch cycles as a monthly administrative task are operating on a timeline their attackers no longer respect.
References
- AI Runs the Hack – Chinese Actor Automates Cyberattacks With DeepSeek
- Chinese Hacker Commands DeepSeek via Telegram to Launch Autonomous Attacks
- Chinese Actors Leverage AI Tools for Automated Cyberattacks
- Chinese Hacker Uses DeepSeek AI to Orchestrate Vulnerability Exploits
- NIST National Vulnerability Database
This post is also available in:
Svenska
