AI Agent Orchestrated via Telegram Conducts Autonomous Attacks: Over 460 Targets Hit

On July 31, 2026, Unit 42 researchers disclosed a case that marks a leap in offensive cyber operations: a Chinese-speaking threat actor used the DeepSeek model, integrated into the open-source Hermes Agent framework, to conduct attacks without any human intervention after a single command sent via Telegram. The operation reached over 460 targets and combined fully autonomous workflows with parallel manual activities.

The Anatomy of the Attack: One Message and Then Operational Silence

The agent, controlled by the alias knaithe/KnYuan, received the initial order via a Telegram chat. From that moment, it operated fully autonomously: it queried the FOFA engine to locate exposed systems, searched for proof‑of‑concepts on GitHub, and selected vulnerabilities to exploit based on severity, prevalence, and ease of execution. Once targets were identified, it downloaded and launched public exploits, managing the entire chain without further clicks.

The activity consisted of 7 exploit tracks covering 8 CVEs. Automatic attacks against workflow and notebook platforms — Langflow (CVE‑2026‑33017) and n8n (chain CVE‑2026‑21858 + CVE‑2025‑68613) — failed because the systems reached did not meet the required configuration prerequisites. In parallel, the operator conducted confirmed manual actions: data exfiltration from 3 organizations via Citrix NetScaler (CVE‑2026‑3055) and command execution on 11 Marimo instances (CVE‑2026‑39987). Overall, only 3 successful compromises were verified across the entire campaign.

The Exploited Vulnerabilities: Four Platforms Under Fire

The flaws fall into critical categories — remote code execution, code injection, unauthenticated file access, and memory overread. Here are the details for each product:

• Langflow: CVE‑2026‑33017 allows arbitrary code execution; the fixed version is 1.9.0.
• n8n: the combination of the two vulnerabilities (CVE‑2026‑21858 and CVE‑2025‑68613) can lead to server compromise; the build that resolves them is 1.121.1 (alternatively 1.121.0 + 1.120.4 or 1.122.0).
• Marimo: CVE‑2026‑39987 allows command execution; update to at least release 0.23.0.
• Citrix NetScaler ADC/Gateway: CVE‑2026‑3055, if the SAML IdP configuration is incorrect, allows unauthorized access; apply the builds indicated in the official security bulletin and verify the presence of the setting add authentication samlIdPProfile .*.

The AI agent used DeepSeek as the main engine, with marginal use of Claude Code, Qwen Code, and Codex.

The Mistake that Revealed the Infrastructure

The attacker made a decisive misstep: they started an HTTP server on /home/worker, inadvertently exposing configuration files, API keys, exploit scripts, target lists, and session logs. This exposure allowed researchers to reconstruct the entire operation, analyze tools and methodology, and confirm the attack's origin. The operator, likely based in Zhuhai (China), has not been linked to known groups or state-sponsored activities.

How to Protect Yourself: Updates and Reducing the Attack Surface

The described campaign shows that an AI agent can orchestrate large-scale attacks without supervision. Defenses should focus on three immediate action lines:

• Apply the listed updates for Langflow, n8n, Marimo, and NetScaler, prioritizing the versions that fix the mentioned CVEs.
• Remove unnecessary public access to workflow and notebook interfaces, especially when not protected by robust authentication.
• Monitor your exposure on services like FOFA and inspect logs for suspicious Python executions, exploit downloads, or anomalous HTTP servers started in user directories.

The 2026 episode confirms that AI-based offensive automation is no longer a theoretical exercise: after the order, the human can disappear from the kill chain.