An AI agent attacked 460 systems. Look at what it targeted.

Palo Alto's Unit 42 published a teardown of an autonomous AI attack campaign that ran with almost no human input, and the interesting detail isn't the AI. It's the target list. Four of the seven exploit tracks aimed at the self-hosted automation and AI tooling that small teams stand up in an afternoon and never think about again. If you run n8n, Langflow, or a notebook server on a box with a public IP, this report is about you.

What actually happened

Unit 42's writeup, published July 30, tracks an operator using the aliases knaithe and KnYuan, assessed to be in Zhuhai, China. The actor wired DeepSeek into the open-source Hermes Agent framework — which supplies terminal access, reusable skills, and unattended execution — and drove it from Telegram. Unit 42 recovered a complete session from May 7, 2026 in which, after the initial instruction, no further operator input appears: the agent enumerated targets, picked vulnerabilities, pulled exploits from GitHub, and ran them on its own.

Across autonomous and manual workflows, the actor attempted to exploit over 460 targets. Seven exploit tracks, spanning eight CVEs:

• Langflow — CVE-2026-33017 (CVSS 9.8). 84 exposed instances enumerated. Failed.
• n8n — CVE-2026-21858 and CVE-2025-68613 chained (10.0 / 9.9). Unit 42 notes 647,017 n8n instances identified globally through FOFA. Failed.
• Citrix NetScaler — CVE-2026-3055 (9.8). Succeeded — data exfiltrated from three organizations, memory scraped for session cookies.
• Marimo Notebook — CVE-2026-39987 (9.8). Succeeded — command execution on 11 instances.
• Apache Tomcat — CVE-2026-34486 (7.5), PAN-OS User-ID Portal — CVE-2026-0300 (9.8), Windows IKE VPN — CVE-2026-33824 (9.8). Attempted or staged.

One clarification worth making, because the roundups blurred it: Unit 42 found the operator had also configured Claude Code, Codex, Qwen, GLM, Kimi, and MiniMax, but reports they were not used often. The report does not establish that other models refused the work. DeepSeek was simply the one wired into the loop.

Why this matters for your business

The AI framing is doing a lot of work in the headlines and not much in the findings. The autonomous runs mostly failed. Both successes came from the boring end of the list — a network appliance and a notebook server, neither of which needed an agent to exploit.

What the agent changed is coverage. A human doing this reconnaissance picks a few hundred targets because attention is finite. An agent enumerated 647,017 n8n instances and worked the list without getting bored. "Too small to be worth the effort" was never a security control, and it is now formally retired.

Then read the target list again, because it is a snapshot of what small companies actually leave exposed. Langflow, n8n, and Marimo are exactly the tools a two-person ops team spins up to automate a workflow, exposes so a webhook can reach it, and never patches — because it isn't the production app, so it isn't on anybody's list. We flagged the n8n sandbox escape and Langflow's agent-builder exposure earlier this year for the same reason. Your automation server holds API keys, database credentials, and OAuth tokens for every system it touches. It is not a side project. It is a skeleton key.

Do the unglamorous thing this week: inventory every self-hosted tool with a public port, confirm it's behind auth or a VPN, and patch the four products above. Then decide whether the webhook endpoint really needed to face the internet at all.

Sources: Unit 42, Palo Alto Networks, BleepingComputer.