Machine-Directed Intrusions Probe Thousands of Internet-Facing Systems
A Chinese-speaking threat actor has been observed building an AI-powered offensive environment capable of performing reconnaissance, researching vulnerabilities, obtaining public exploits, evaluating targets and switching attack strategies with limited human intervention.
The activity, investigated by Palo Alto Networks’ Unit 42, involved the threat actor aliases knaithe and KnYuan. Researchers found that the operation combined an AI reasoning model with the Hermes Agent framework, terminal access, Telegram-based command-and-control, and custom capabilities designed for security testing and exploitation.
The campaign provides a clear example of how AI-driven tooling is moving beyond simple code generation toward more automated offensive workflows.
AI Framework Automates Reconnaissance and Exploit Research
The investigation began after Hermes Agent inadvertently exposed a Python HTTP file server running from the operator's home directory.
The exposed server reportedly contained sensitive operational material, including tool configurations, API keys, target lists, exploit scripts, shell history and logs from previous attack sessions.
The AI model served as the reasoning component, while Hermes Agent handled execution and interaction with the operator's environment.
The threat actor created custom skills for tasks including LLM jailbreaking, unauthenticated WebSocket exploitation and FOFA-based asset discovery.
Researchers also identified an MCP server capable of converting natural-language instructions into FOFA searches, generating Nuclei scans and performing large-scale internet asset discovery.
This setup allowed the operator to give relatively high-level instructions while the automated environment handled multiple stages of reconnaissance and vulnerability assessment.
Automated Target Selection and Vulnerability Testing
One recovered session from May 2026 showed the system downloading a publicly available proof-of-concept exploit for CVE-2026-33017, a critical Langflow vulnerability with a CVSS score of 9.8.
The system used FOFA to locate 84 exposed Langflow installations and identified one host running Langflow 1.3.4 that appeared vulnerable.
However, exploitation ultimately failed because the target did not meet the configuration requirements needed for the attack. The required auto_login setting was absent, and a publicly accessible flow ID could not be obtained.
Instead of repeatedly attacking the same system, the automated workflow assessed the target as having limited value and moved to other technologies.
The system subsequently examined 10 product families and searched GitHub for recently published proof-of-concept exploits, ranking potential targets according to severity, exposure and apparent exploitation potential.
n8n Becomes a High-Priority Target
The automated assessment eventually identified n8n workflow automation as a particularly attractive target.
Researchers found more than 647,000 exposed n8n instances worldwide, including approximately 25,209 located in China.
The operation investigated two serious vulnerabilities:
- CVE-2026-21858 — an arbitrary file-read vulnerability rated CVSS 10.0.
- CVE-2025-68613 — a sandbox-bypass vulnerability rated CVSS 9.9 that could potentially enable remote code execution.
The system downloaded a publicly available exploit and identified three n8n versions that appeared potentially vulnerable. It then searched for publicly accessible form-upload endpoints required to continue the attack.
The attempts were unsuccessful because the discovered forms required authentication.
The automated system then expanded its search to more than 50 additional targets in China but failed to locate publicly accessible upload functionality that could support exploitation.
These unsuccessful attempts demonstrate an important characteristic of the operation: the system was not simply executing a fixed sequence of commands. It was evaluating results and adjusting its next actions according to the information it discovered.
Manual Operations Produced Confirmed Compromises
Although Unit 42 did not confirm successful compromises from the AI-directed sessions, researchers linked the same actor to successful manually conducted operations.
The threat actor reportedly compromised three organizations by exploiting CVE-2026-3055 in Citrix NetScaler.
The actor also achieved command execution on 11 Marimo notebook instances through CVE-2026-39987.
Additional activity included attempts to establish reverse shells against Apache Tomcat systems and Windows IKE VPN endpoints.
Across both automated and manually controlled operations, the actor reportedly targeted more than 460 systems.
The Citrix activity was particularly notable because the operator searched stolen memory data for NSC_AAAC authentication cookies, indicating an attempt to hijack authenticated sessions.
Palo Alto Networks also observed repeated activity against a Malaysian government organization, with the attacker refining exploitation parameters while using proxy infrastructure to conceal the source of the activity.
AI Reduces the Time Between Discovery and Attack
The significance of the campaign extends beyond the individual vulnerabilities involved.
Traditional intrusion operations often require an attacker to manually search for exposed assets, identify software versions, research applicable vulnerabilities, obtain proof-of-concept code and determine whether an attack is practical.
The investigated infrastructure automated much of that process.
The system could discover exposed assets, compare software versions, locate relevant exploits, test potential targets and abandon unsuccessful avenues in favor of other opportunities.
That creates a significant advantage for attackers because internet-facing infrastructure can be assessed at machine speed.
At the same time, the investigation shows that automation does not guarantee successful exploitation. Authentication requirements, secure configurations and missing attack prerequisites prevented several of the observed attempts from succeeding.