An AI Agent Attacked 460 Targets by Itself and Got Three. The Autonomy Is Real. The Hit Rate Is Not Scary Yet.
- Patrick Duggan
- 30 minutes ago
- 4 min read
Unit 42 published a reconstruction of a campaign run by a Chinese-speaking actor tracked as knaithe, also KnYuan. The setup deserves attention and so does the outcome, and most coverage will only give you the first one.
The actor wired up DeepSeek's Hermes Agent — an open-source agentic framework — to take instructions from a Telegram channel, loaded it with custom offensive-security skills, and connected it to FOFA, an internet asset search engine. Then, in a May 2026 session Unit 42 recovered, the operator gave it an initial task and appears to have stopped participating. The agent did the rest on its own: researched vulnerabilities, decided which targets were worth attacking, fetched exploit code, and fired.
That is a genuinely autonomous offensive loop, and it compressed work that normally takes hours into minutes.
It attacked more than 460 targets. It confirmed three.
The funnel
0.65%. An untiring attacker with seven exploits, automated target selection and no need to sleep managed a success rate that would embarrass a human penetration tester.
The kit was Langflow, n8n, Citrix NetScaler, Apache Tomcat, Marimo Notebook, Palo Alto PAN-OS, and Microsoft Windows IKE Extensions. Every one of those is a known, catalogued vulnerability. There is no zero-day here. The agent was reaching for the same commodity KEV entries any defender can already see coming.
Why it missed
This is the part worth reading twice, because it explains the number.
The Langflow and n8n attempts failed because the exposed systems did not meet the exploits' configuration requirements. Not because anyone blocked it. Not because of EDR. Because real deployments differ from the lab, and an exploit written against one configuration does not fire against another.
That is the oldest reason attacks fail, and it turns out to apply to machines exactly as it applies to people. The agent could not tell, from outside, which of its 460 candidates would actually satisfy its exploits' preconditions — so it tried them all, and 457 times the answer was no.
Autonomy solved the labour problem. It did nothing about the precision problem.
The two named failures are two we had just written up
We published a defender playbook for Langflow on 22 July, when it became the fifth entry in that product's KEV history. We published on n8n on 27 July — its third sandbox escape, shipped without a CVE.
Those are the two exploits Unit 42 names as failing.
We are not claiming credit and there is no mechanism by which we would deserve any. Those attacks failed on configuration mismatch, not because an operator read us. The useful observation is narrower and sturdier: the exploits an autonomous agent reaches for are the ones already sitting in KEV, already written about, already patchable. The frontier of AI-assisted attack is currently pointed at your unpatched Tomcat.
What is actually new, stated plainly
Three things changed, and none of them is capability.
Speed. Research, target selection, exploit retrieval and delivery in minutes instead of hours. That compresses the window between a vulnerability becoming public and someone trying it against you. If your patch cycle assumed you had a week of obscurity, you have less.
Volume per operator. One person launched 460 attacks without supervising them. The constraint on opportunistic attack used to be attacker attention. It is now the price of tokens.
Command surface. The whole thing ran from a Telegram channel. No infrastructure to seize, no C2 to sinkhole, no server to take down — the operator typed into a chat app and the agent went to work. That is a real problem for the takedown model, and it is more interesting than the exploitation.
What has not changed
The exploits are public. The vulnerable configurations are the same ones that were vulnerable last month. The success rate is under one percent. And the fix for every one of the seven is the fix it was before an AI got involved: patch it, or don't put it on the internet.
We have spent a lot of the last year writing about AI as an attack surface — models tricked, agents manipulated, evaluation environments escaping into production. This is the other direction, AI as the attacker, and the honest summary is that it is early and it is not very good.
That should not be read as comfort. A 0.65% hit rate against 460 targets is still three compromised organisations, and the operator's cost per attempt is approaching zero. When the same loop gets better target triage — the ability to tell, before firing, whether a host actually satisfies the exploit's preconditions — the number moves. The interesting question is not whether autonomy works. It is what happens when it stops wasting 457 attempts.
What to do
Nothing exotic. Patch the seven if you run them: Langflow, n8n, Citrix NetScaler, Apache Tomcat, Marimo Notebook, PAN-OS, Windows IKE Extensions. The first two have current defender guidance from us and better from their vendors.
Then reduce the window. The change here is timing, so the defence is timing: shorten the gap between a KEV listing and your patch, because the thing on the other side no longer needs to schedule its afternoon.
And if you are looking for the exotic answer — a detection for "AI-driven attacks" — there isn't one, because nothing on the wire looks different. It is the same exploit, sent by the same protocol, from the same class of host. Only the tempo changed.
Confidence capped at 95%. Campaign details, target counts, exploit list, and the confirmed-success figure are from Unit 42's published research, which is the primary source and deserves the credit. We have no independent telemetry on this campaign and hold no indicators from it. Our Langflow and n8n coverage is cited as context, not as a claim of any role in the outcome.
Every indicator in this post is in the feed. Free.
1.58M+ IOCs, STIX 2.1 / TAXII, 88% novel vs ThreatFox, exploited-CVE leads ahead of CISA. No credit card — a free API key in 30 seconds, and you can audit every claim above against the live endpoints.