Unit 42 uncovers AI-enabled autonomous hacking campaign

You can’t judge a person unless you’ve walked a mile in their shoes. But you can judge a hacker once you’ve accessed their operational environment.

That was the case for Palo Alto Networks subsidiary Unit 42 when an autonomous agent exposed the infrastructure of an AI-enabled attack sequence by accidentally starting a file server in its home directory.

“We were able to read through their configuration files and their LLM chat logs, for lack of a better word, their instructions they were passing to the LLMs,” Andy Piazza, senior director of threat research at Unit 42, told IT Brew. “So, we could see them testing and trying various attacks.”

The TL;DR on the attack. Unit 42, which detailed its findings in a July 30 research report, said the campaign was executed by a Chinese-speaking threat actor that goes by the aliases

“knaithe” and “KnYuan.” The primary tool of choice for the campaign was AI model DeepSeek via the Hermes Agent open-source framework. The Hermes Agent fulfilled the orchestration function, while DeepSeek acted as a reasoning agent (i.e., the agent in charge of decision-making).

The offensive AI tool helped the threat actor list targets and vulnerabilities, find exploit tools, and initiate attacks without human intervention. When initial exploitations were unsuccessful, Unit 42 observed that the Hermes agent was able to search for known CVEs and ultimately target “higher-value” vulnerabilities based on its research.

DeepSeek wasn’t the only AI tool leveraged during the campaign. Claude Code was used for connectivity testing and proxy validation. There were also signs that indicated the use of the agentic tools Codex and Qwen Code.

In its research, Unit 42 said the threat actor tried to exploit more than 460 targets through a mix of autonomous and manual techniques. Unit 42 was only able to confirm that three of them were successfully exploited.

“Overall, they weren’t very successful,” Piazza said. “They got some basic memory leak, so basically got to hit the perimeter of a couple organizations and got some basic data, but it’s not the big, damning silver bullet that everybody’s looking for right now.”

Takeaways. There’s a lot to be learned from this autonomous hacking campaign. Piazza said enterprises should make sure they are securing AI models beyond what’s present in the AI configuration file.

“Most companies that have a website now, they have a web application firewall. We don’t rely on the website to protect itself anymore,” Piazza said. “I think it’s the same thing with AI. We need to be putting security tools in front of it for visibility, but also like a web application firewall, we should be filtering what commands and responses are expected and authorized from our AI systems, so they don’t open and expose themselves.”

He added companies should try to get a better understanding of their AI footprint within their organization so that they can properly secure it.

“The technology sprawl is actually pretty broad, and I don’t think that enterprises quite understand that,” Piazza said. “We’re adding things to the network and those things need to be secured, and we need a better understanding of how to secure them.”

Finally, Piazza reminds companies that AI attacks are still rare at this time.

“Most of the AI attacks we’re seeing are not very successful,” Piazza said. “They’re still trying to figure it out. We still have a chance to get ahead of this and do this securely in the right way.”