For years, automated cyberattacks were largely deterministic. Security operations centers (SOCs) defended against signature-based port scanners, basic brute-force scripts, and hardcoded exploit payloads. If an exploit failed, a bash script didn’t pause to analyze the stack trace, search GitHub for a newer Proof-of-Concept (PoC), refine its payload, and execute a second attempt. It simply threw an error, failed, and moved on.

That paradigm has officially shifted. We have entered the era of the unattended threat, where offensive operations are governed not by static scripts, but by agentic AI loops capable of dynamic reasoning, continuous task execution, and real-time decision-making.

A stark example of this operational evolution emerged with the discovery of the ‘knaithe’ cyberattack campaign. In this operation, a Chinese-speaking threat actor leveraged open-source large language models (LLMs) and agentic frameworks to deploy an autonomous cyberattack engine. The agent systematically evaluated and probed over 460 target systems across multiple infrastructure components without requiring real-time human instruction for individual exploit decisions.

This campaign highlights a broader shift in offensive operations. As discussed in recent analyses of autonomous AI agent cyberattacks, the barrier to executing multi-stage, adaptive attacks has dropped significantly. By combining open-weights models like DeepSeek with agent frameworks, threat actors can convert high-level operational goals into multi-step, autonomous execution loops.

However, the knaithe campaign also revealed a striking paradox in modern cyber warfare: while the attacker utilized state-of-the-art agentic orchestration for their offensive pipeline, the entire operation was ultimately exposed by a fundamental human Operational Security (OpSec) blunder.

The Stack: DeepSeek, Hermes, and the Agentic Loop

To understand how an autonomous cyberattack operates without constant human oversight, we must deconstruct the technology stack that powered the knaithe operation. The attacker did not build an AI model from scratch; instead, they combined open-source tools into an integrated, self-directing workflow.

+-------------------------------------------------------------------+
|                        Threat Actor (knaithe)                     |
+-------------------------------------------------------------------+
                                  |
                   [ Telegram API / Command Interface ]
                                  v
+-------------------------------------------------------------------+
|                       Hermes Agent Framework                      |
|  - Task Decomposition                                             |
|  - Tool Call Orchestration & State Management                     |
+-------------------------------------------------------------------+
                                  |
                                  v
+-------------------------------------------------------------------+
|                            DeepSeek LLM                           |
|  - Strategic Reasoning & Log Parsing                              |
|  - Dynamic Query & Payload Generation                             |
+-------------------------------------------------------------------+
                                  |
           +----------------------+----------------------+
           |                                             |
           v                                             v
+---------------------+                       +---------------------+
|  FOFA Search Engine |                       |  GitHub API Engine  |
|  (Target Discovery) |                       |  (PoC Acquisition)  |
+---------------------+                       +---------------------+
           |                                             |
           +----------------------+----------------------+
                                  |
                                  v
+-------------------------------------------------------------------+
|                  Target Systems (460+ Instances)                  |
|  - Langflow (CVE-2024-4320)       - Marimo (CVE-2024-4251)        |
|  - n8n (CVE-2024-45188)           - Citrix (CVE-2023-3519)       |
+-------------------------------------------------------------------+

1. DeepSeek LLM: High-Performance Reasoning at Scale

At the core of the reasoning engine was DeepSeek. The rapid advancement of open-weights LLMs has fundamentally changed the economics of autonomous threat operations. Historically, running complex reasoning models required expensive API integrations with proprietary vendors or massive GPU infrastructure.

DeepSeek offers high-tier reasoning and code synthesis at a fraction of the operational cost of proprietary models. Because the model can be hosted locally or accessed via lower-cost API endpoints without the stringent safety guardrails imposed by commercial enterprise providers, it serves as an ideal brain for offensive automation. It can parse raw terminal outputs, read error logs, generate Python code, and output structured tool calls in formats like JSON.

2. Hermes Agent Framework: Orchestrating the Offensive Loop

An LLM alone is simply a text processor; it cannot interact with the physical network or run terminal commands without an execution layer. The threat actor implemented the Hermes Agent Framework to bridge this gap.

Hermes provides the memory management, execution capabilities, and tool-calling structures required for an AI model to interact with external environments. It allows the model to:

  • Maintain context over long-running, multi-step tasks.
  • Execute local terminal commands (e.g., curl, python3, nmap).
  • Call external APIs conditionally based on previous outputs.
  • Retain state across session drops or tool failures.

3. The Agentic Loop Architecture

The operation was initiated via a Telegram API interface, where the human operator could issue high-level directives (such as "Find vulnerable orchestration tools and attempt exploit chain X"). Once the directive was received, the system initiated an agentic loop:

  1. Directive Parsing: Hermes forwards the command to DeepSeek, which breaks the goal down into tactical steps.
  2. Tool Selection: DeepSeek selects the appropriate tool (e.g., executing a FOFA query script).
  3. Execution: Hermes runs the command in the local environment and captures the STDOUT, STDERR, and network responses.
  4. Evaluation: DeepSeek analyzes the output. If the step succeeded, it proceeds to the next objective. If it failed, it refines the parameters and retries.

This closed loop operated continuously without human interference, enabling the agent to target hundreds of systems simultaneously.

Anatomy of an Attack: From Reconnaissance to Exploitation

The knaithe operation was structured into three distinct operational phases: target discovery, exploit acquisition, and active evaluation/exploitation.

+-------------------+      +-------------------+      +-------------------+
|  1. Reconnaissance| ---> | 2. PoC Acquisition| ---> |   3. Evaluation   |
|   (FOFA Searching)|      | (GitHub Scraping) |      |   & Exploitation  |
+-------------------+      +-------------------+      +-------------------+

Phase 1: Automated Target Discovery via FOFA

Rather than scanning IP ranges manually or using generic network mappers, the agent queried FOFA—a cyberspace search engine similar to Shodan that indexes internet-connected devices, open ports, and HTTP header banners.

The agentic framework autonomously generated syntax-valid FOFA search queries targeting exposed administrative panels and specific workflow tools. For example, the agent instructed Hermes to issue HTTP requests to FOFA’s API to extract lists of IP addresses and ports matching signatures for vulnerable services.

# Conceptual representation of the agent's FOFA query generation
import requests
import base64

def generate_fofa_query(app_signature):
    # The agent formulates queries dynamically based on target app traits
    query = f'app="{app_signature}" && status_code="200"'
    encoded_query = base64.b64encode(query.encode('utf-8')).decode('utf-8')
    
    api_url = f"https://fofa.info/api/v1/search/all?key=USER_KEY&qbase64={encoded_query}"
    response = requests.get(api_url)
    return response.json()

By leveraging FOFA, the agent bypassed the need to send direct port-scanning traffic to target subnets during the initial phase, avoiding standard network-level IDS triggers until it was ready to strike specific, pre-qualified targets.

Phase 2: PoC Acquisition from GitHub

Once target IP lists were established, the agent did not rely solely on hardcoded attack vectors. If it encountered a specific software version or service banner, it queried GitHub’s API or scraped repository search results to pull public Proof-of-Concept (PoC) exploit scripts.

The DeepSeek engine read the code contained within the retrieved repositories, checked the language requirements (e.g., Python dependencies), and modified the parameters—such as setting the target IP (RHOST), port (RPORT), and reverse shell parameters—to match the target environment identified during the recon phase.

Phase 3: The Dynamic Evaluation Engine

What distinguishes this attack from traditional botnet activity is the agent’s Evaluation Engine. Standard attack scripts follow rigid logical paths: if target_open -> send payload -> exit. The knaithe agent implemented a dynamic feedback loop:

[ Target Response Received ]
             |
             v
  Does response match success pattern?
        /         \
      YES          NO
      /             \
[ Log System   [ Extract Stack Trace / Error ]
 as Compromised]     |
                     v
             [ Send Error to DeepSeek ]
                     |
                     v
             [ Generate Alternate Payload ]
                     |
                     v
             [ Retry Exploitation ]

When probing target systems, the agent evaluated the raw HTTP response headers, response bodies, and system return codes. If an exploit returned a status code like 500 Internal Server Error or a specific framework exception, DeepSeek parsed the error text in real time. It then modified the request structure (such as altering payload encoding, bypassing simple web application firewall headers, or attempting alternative API paths) before executing a secondary attack.

Through this methodology, the agent systematically probed and processed more than 460 target systems across varied environments with minimal human input.

Targeting the Modern Stack: CVEs in AI and Automation Tools

A notable element of the knaithe campaign was its choice of targets. Rather than focusing exclusively on legacy enterprise infrastructure, the actor directed the agent to seek out modern infrastructure orchestrators, automation platforms, and AI development environments.

               +----------------------------------+
               |     Attacker's Central Agent     |
               +----------------------------------+
                                |
        +-----------------------+-----------------------+
        |                       |                       |
        v                       v                       v
+---------------+       +---------------+       +---------------+
|   Langflow    |       |      n8n      |       |    Marimo     |
| (CVE-2024-4320|       |(CVE-2024-45188|       | (CVE-2024-4251|
|  AI Pipelines)|       | Workflow Hub) |       | Python Shells)|
+---------------+       +---------------+       +---------------+
        |                       |                       |
        +-----------------------+-----------------------+
                                |
                                v
               +----------------------------------+
               | Primary Target: High-Privilege   |
               | API Keys, Cloud Credentials,     |
               | & Internal Network Pivoting      |
               +----------------------------------+

Why Target AI and Automation Orchestrators?

Developer environments and workflow tools make ideal entry points for modern threat actors:

  1. High Privileges & Unrestricted Execution: Tools like Langflow and n8n are designed to execute arbitrary code, connect to primary databases, and interact with cloud service APIs.
  2. Credential Richness: These tools frequently store third-party API keys (e.g., OpenAI, AWS credentials, database strings) in plain text or weakly encrypted local environment variables.
  3. Lower Security Visibility: While traditional web servers and enterprise databases are heavily monitored by EDR and SIEM solutions, self-hosted AI developer tools are often deployed by engineering teams on internal or exposed staging servers without centralized security oversight.

Similar pattern shifts were documented in the security incidents involving autonomous agent breaches on platforms like Hugging Face, where exposed AI pipeline tools provided direct pathways to sensitive assets.

Breakdown of Targeted Vulnerabilities

The knaithe operation specifically targeted a cluster of vulnerabilities spanning AI execution frameworks, workflow tools, and traditional networking access points:

CVE Identifier Target Application Vulnerability Type Operational Advantage to Agent
CVE-2024-4320 Langflow Code Injection / Remote Code Execution Enables arbitrary Python code execution on hosts running exposed Langflow UI environments.
CVE-2024-45188 n8n Unauthenticated Access / Path Traversal Provides direct access to workflow orchestration configurations and sensitive environment credentials.
CVE-2024-4251 Marimo Remote Code Execution Exploits reactive Python notebook instances to run unauthorized backend terminal commands.
CVE-2023-3519 Citrix NetScaler Unauthenticated Remote Code Execution Provides network edge access, facilitating lateral movement and long-term persistence in enterprise networks.

Langflow (CVE-2024-4320) & n8n (CVE-2024-45188)

By targeting Langflow and n8n, the knaithe agent sought to compromise the systems managing enterprise data movement. Successfully exploiting a Langflow instance gives an attacker instant access to underlying model pipelines and integrated vector databases. Similarly, hijacking an n8n deployment grants control over automated business workflows, permitting remote command execution and payload injection across linked corporate applications.

Marimo (CVE-2024-4251) & Citrix NetScaler (CVE-2023-3519)

Marimo, an open-source reactive notebook for Python, allowed the agent to achieve backend command execution by manipulating input fields in unprotected instances. To ensure long-term persistence and enable lateral movement outside the developer environment, the agent incorporated CVE-2023-3519, a critical vulnerability in Citrix NetScaler ADC and Gateway appliances. This combination allowed the threat actor to pivot from cloud-native developer stacks back into corporate networks.

The Irony of OpSec: How ‘python3 -m http.server’ Exposed the Ghost

Despite the advanced nature of the autonomous agentic stack, the knaithe campaign came to a sudden halt due to basic human operational error.

The Fatal Mistake

While configuring their operational environment, the threat actor needed to transfer files and access session logs generated by the agent. Rather than setting up an encrypted, authenticated file server or utilizing secure access controls, the actor executed a basic Python command directly inside the agent’s root working directory:

python3 -m http.server 8888

This single command launched an unauthenticated, plain-text HTTP web server on port 8888, exposing the local file system structure to the public internet.

/working_directory/
│
├── agent_logs/
│   ├── session_2026_03.json    <-- Full LLM prompt & response history
│   └── target_460_results.log  <-- Execution traces & output logs
│
├── scripts/
│   ├── fofa_recon.py           <-- Target discovery tools
│   └── github_poc_scraper.py   <-- Exploit acquisition scripts
│
└── config/
    └── system_prompts.meta     <-- Internal instructions in Chinese

What the Exposed Logs Revealed

Security researchers who discovered the open web server were able to download raw log files, JSON session dumps, and executable scripts. The logs provided an unredacted look into the agent’s operations:

  1. Attacker Attribution: Log records contained comments, prompt instructions, and error logging written in Chinese, linking the operational identity to the actor known as ‘knaithe’.
  2. LLM Decision Records: The session dumps captured the complete prompt history between the Hermes framework and DeepSeek. Researchers observed the exact process by which the LLM evaluated stack traces, adjusted payload arguments, and made decisions when exploits failed.
  3. Complete Target List: The exposed logs contained the IP addresses, domain names, and vulnerability statuses for all 460+ targeted systems, allowing blue teams to quickly notify affected organizations and initiate remediation efforts.

The High-Tech / Low-Tech Paradox

The knaithe incident illustrates a clear operational contrast in modern cyber threats. While advanced tools allow small teams or individual actors to operate complex attack frameworks, overall operational security remains subject to basic human error. An advanced, LLM-driven autonomous agent can still be undone by simple misconfigurations made by its human operator.

Defending Against the Machine: Detection and Mitigation

Defending against AI-driven, autonomous agents requires security teams to update their detection approaches. Traditional signatures designed for static attack scripts often fail against dynamic agents that adapt their payloads in real time.

+-------------------------------------------------------------------+
|               Defensive Depth for Agentic Threats                 |
+-------------------------------------------------------------------+
|  1. Network & API Monitoring                                      |
|     - Detect multi-engine querying (FOFA -> GitHub -> Target)     |
|     - Monitor anomalous rate patterns and systemic agent headers  |
+-------------------------------------------------------------------+
|  2. Hardening Modern Developer Tools                              |
|     - Isolate Langflow, n8n, & Marimo behind SSO / Zero Trust     |
|     - Disable unauthenticated execution endpoints                 |
+-------------------------------------------------------------------+
|  3. AI-Assisted Security Operations (AI-on-AI Defense)             |
|     - Deploy defensive agents to analyze incoming payload variance|
|     - Automate dynamic IP blocklists for adaptive scanning attempts|
+-------------------------------------------------------------------+

1. Monitoring for Anomalous API and Tool-Calling Behavior

While an AI agent can alter payload formatting, its structural behavior across the network reveals distinct patterns:

  • Rapid Tool Chaining: Look for single source host IPs executing distinct multi-stage API queries within narrow time windows (e.g., querying FOFA API endpoints, fetching raw code blocks from GitHub, and immediately initiating outbound HTTP POST requests to enterprise management portals).
  • Automated Payload Variance: Monitor web application firewalls (WAF) for high-frequency requests coming from a single client that continuously alters parameter encoding (e.g., base64 to URL encoding to double-URL encoding) following HTTP 500 error responses.
  • Unusual HTTP User-Agents: Agent frameworks running on standard Python runtimes often rely on default HTTP libraries (e.g., python-requests/2.31.0) unless explicitly configured otherwise by the prompt structure.

2. Hardening AI Orchestration Infrastructure

Because platforms like Langflow, n8n, and Marimo serve as critical pivot points, organizations must harden these deployments:

  • Enforce Strict Authentication: Never expose developer interfaces or workflow orchestrators directly to the public internet without authentication. Place them behind Zero Trust Network Access (ZTNA) solutions, VPNs, or identity-aware proxies (IAPs).
  • Apply Network Segmentation: Ensure that systems hosting automation engines cannot freely initiate outbound connections to internal network segments or critical infrastructure without explicit egress filtering.
  • Network Control Example (iptables / Egress Rules): Block developer orchestration pods from communicating with arbitrary external search engines or public code repositories unless required for business operations.
# Example: Restrict outbound connectivity for isolated AI application containers
# Block container network interface from making arbitrary external web queries
iptables -A FORWARD -i docker0 -p tcp --dport 80 -m string --algo bm --string "fofa.info" -j DROP
iptables -A FORWARD -i docker0 -p tcp --dport 443 -m string --algo bm --string "fofa.info" -j DROP

3. Deploying “AI-on-AI” Defenses

As threat actors deploy autonomous agents, defensive operations must match their processing speed. Modern SOC environments are integrating automated defensive agents capable of evaluating inbound malicious activity in real time.

# Conceptual Defensive Agent logic for evaluating adaptive payload sequences
class DefensiveAgent:
    def __init__(self, threat_threshold=0.85):
        self.threshold = threat_threshold

    def analyze_request_sequence(self, client_ip, request_history):
        """
        Analyzes incoming request sequences to detect adaptive LLM-driven probing.
        """
        error_retry_count = sum(1 for req in request_history if req.status_code in [500, 403])
        payload_variance = len(set(req.body_hash for req in request_history))

        # Detect high variance in payloads following server errors (indicative of agent loops)
        if error_retry_count > 3 and payload_variance > 3:
            self.trigger_automated_block(client_ip)
            return True
        return False

    def trigger_automated_block(self, ip):
        print(f"[DEFENSE ALERT] Blocking IP {ip} due to dynamic payload probing signature.")

Future Outlook: The Industrialization of Autonomous Hacking

The knaithe campaign represents an early operational case study in autonomous cyber security threats, illustrating how quickly agentic AI can be deployed against public targets.

The Democratization of Attack Pipelines

The availability of high-performing open-weights models like DeepSeek, combined with open-source frameworks like Hermes, significantly lowers the technical barrier for threat actors. Complex operational techniques—such as real-time log parsing, context-aware payload modification, and tool orchestration—no longer require extensive software engineering teams. They can be defined in plain language prompts and executed by agentic frameworks.

The Emerging Risk of Multi-Agent Swarms

As these tools evolve, operations will likely transition from single-agent loops to multi-agent swarms. In a swarm architecture:

  • Reconnaissance Agents continuously query cyberspace search tools and index exposed targets.
  • Exploit Generation Agents analyze software vulnerabilities, synthesize PoC payloads, and adjust code structure.
  • Persistence Agents establish command-and-control (C2) infrastructure, manage credentials, and initiate lateral movement.

These specialized agent teams will operate concurrently, sharing target state information through centralized memory systems.

Final Thoughts

The knaithe operation demonstrates both the potential and the current limitations of autonomous cyber threats. While the combination of DeepSeek and Hermes enabled rapid, automated evaluation of hundreds of systems, it was ultimately exposed by simple operational errors.

For defenders, this incident serves as a clear warning. The speed, adaptability, and scale of offensive cyber operations are changing rapidly. Protecting systems now requires securing developer pipelines, closing vulnerable entry points, and implementing security controls capable of detecting adaptive, machine-driven threats.