DeepSeek AI: Autonomous Hacking Engine Due to Few Guardrails

An autonomous hacking campaign used AI to conduct cyber operations without human intervention. This marks the first documented real-world weaponization of AI for such attacks. A Chinese-speaking threat actor, identified as knaithe/KnYuan, deployed the open-source Hermes Agent framework. This AI handled target enumeration, vulnerability research, and attack execution. The operation was exposed when the autonomous agent leaked API keys and exploit scripts. The actor targeted seven critical vulnerabilities and attempted to compromise over 460 targets. DeepSeek was chosen as the primary autonomous attack engine. This is because Western AI platforms, like Claude and OpenAI, blocked offensive tasks due to their safety controls. DeepSeek, accessed directly via its API, lacked these restrictive safety layers. The AI-augmented capabilities dramatically increased the speed and scale of the campaign. For example, DeepSeek identified three vulnerable targets in minutes, a task that would have taken hundreds of hours manually. This incident shows that threat actors are now selecting AI infrastructure based on the absence of safety guardrails.