DeepSeek Agent Conducts Autonomous Cyberattacks, Bypassing Human-in-the-Loop Controls
Source
Hacker uses DeepSeek AI to autonomously attack vulnerable serversPalo Alto Networks Unit 42 / Bleeping Computer
What happened
Palo Alto Networks Unit 42 published research documenting a Chinese-speaking threat actor who used the DeepSeek AI model paired with the open-source Hermes Agent framework to run a largely autonomous cyberattack chain against exposed servers, as reported by Hacker uses DeepSeek AI to autonomously attack vulnerable servers. The agent independently queried the FOFA threat intelligence platform to identify vulnerable targets, researched applicable exploits, downloaded attack code, and executed attempts within minutes, compressing what analysts estimate would require hundreds of hours of manual work. Human involvement was minimal throughout the chain, meaning the attacker functioned primarily as a supervisor rather than an operator. The attack demonstrates that commodity open-weight models combined with open-source orchestration frameworks are sufficient to build an autonomous offensive capability, without access to restricted or purpose-built tools. This follows earlier research showing that UK AISI and CAISI found Kimi K3 safeguards failed to block offensive cyber attempts ahead of open-weight release, reinforcing a pattern of publicly available models enabling offensive use cases that governance frameworks have not yet caught up to.
Why it matters
- ·Human-in-the-loop controls, which most AI risk frameworks including the NIST AI Risk Management Framework Playbook treat as a primary safeguard against harmful AI outputs, are rendered ineffective when an adversary deliberately removes themselves from the loop. Enterprises that have justified lower-risk classifications for AI use cases on the basis of human oversight must now account for the fact that the same design principle does not constrain adversarial deployments targeting their infrastructure.
- ·The attack chain relied entirely on an open-weight model and a publicly available agent framework, meaning no proprietary or restricted tools were required. Enterprises that have approved open-weight AI model intake without completing a formal adversarial-use or dual-use assessment now face documented evidence that such assessments cannot be deferred, and that open-source model governance is a security surface, not just a procurement or licensing question.
- ·Autonomous attack cycles measured in minutes rather than hours compress the window between vulnerability disclosure and exploitation, making existing patch management timelines and human-reviewed incident response playbooks structurally inadequate against AI-accelerated threats. This has direct implications for how compliance teams size and test their AI Incident Response Playbook exercises and escalation SLAs.
Stay ahead of stories like this
Get every Global AI governance development like this one, plus the rest of the week's developments. Every Thursday.
Recent issues
- State-linked attackers and criminal operators are actively weaponizing AI tools as entry points into enterprise systems, turning internal platforms and open-source frameworks into live attack vectors.5 Nov
- Three separate incidents this week each created a new compliance action item: verify your AI vendors' data sourcing, demand agent monitoring coverage guarantees, and audit trusted app identities in your cloud environment.29 Oct
Free every Thursday. Unsubscribe anytime.
Governance controls affected
What to do now
- ☐Review every approved open-weight AI model deployment against a formal dual-use and adversarial-use assessment, and flag any that were approved without one for immediate reassessment.
- ☐Audit human-in-the-loop gate designs in your agentic AI governance controls to confirm they cannot be trivially bypassed by removing the human operator, and document any gaps identified.
- ☐Update incident response playbooks to account for AI-accelerated attack timelines, specifically shortening the assumed window between vulnerability identification and attempted exploitation.
- ☐Require your red-teaming program to include agentic offensive simulation scenarios that combine open-source model access with publicly available orchestration frameworks, not just prompt injection and model-specific tests.
- ☐Assess whether your patch management SLAs and vulnerability disclosure response times remain adequate given evidence that autonomous AI agents can move from target identification to exploit execution in minutes.
What to watch next
Compliance teams should monitor whether threat intelligence bodies and sector-specific regulators begin issuing formal guidance on AI-accelerated attack timelines and their implications for existing cybersecurity control standards, particularly under frameworks such as the EU Cyber Resilience Act and EU Digital Operational Resilience Act. The Unit 42 finding is likely to accelerate regulatory and standards-body interest in mandatory adversarial assessment requirements for open-weight model deployments. Teams should also watch for updated agentic AI security benchmarks from NIST and OWASP, following the recent OWASP update to its agentic AI vulnerability baseline, which may formalize autonomous attack-chain testing as an expected pre-deployment control.