The most interesting line in Unit 42’s report is not about the attacker. It is about the two AI providers that refused to help him.
One Telegram message, then the AI took over
Unit 42 tracked the actor under the alias knaithe, also known as KnYuan, assessed with moderate confidence as operating out of Zhuhai, China. According to the researchers, knaithe connected DeepSeek to Hermes Agent, an open-source autonomous agent framework, and built a pipeline that could scan for exposed targets, research how to exploit them, and carry out the exploitation with minimal further input. Unit 42 describes the human operator’s role as sending a single command over Telegram and then largely stepping back while the pipeline ran. The campaign reached more than 460 targets across eight CVEs and seven distinct exploit tracks, hitting self-hosted deployments of Citrix NetScaler, Langflow, Marimo and n8n, tools that sit in a huge number of European DevOps and data science stacks. Unit 42 confirmed data exfiltration from three Citrix NetScaler targets and command execution on eleven Marimo notebook endpoints.
Claude and OpenAI said no
Before settling on DeepSeek, Unit 42 found evidence the actor attempted to build the same autonomous pipeline on Claude and OpenAI models, and that both providers’ safety controls refused to cooperate with the offensive tasking. DeepSeek did not have the same guardrails in the way. That distinction matters beyond this one campaign: it is the first real-world confirmation that AI provider safety controls have measurable, operational value as a defensive layer, not just a compliance checkbox. For any organisation evaluating which AI models to build agentic tooling on top of, or which models a vendor uses inside a product you rely on, this is now a concrete data point rather than a theoretical concern.
Caught by his own tooling, not a defender
The operation only came to light because knaithe misconfigured his own Hermes Agent instance and exposed the full operational workspace to the open internet, including tool configurations, API credentials, exploit scripts, target lists and session logs from autonomous exploitation runs. Separately, Unit 42’s own table of activity shows the actor also manually exploited CVE-2026-33824, a critical double-free vulnerability in the Windows IKE service extensions used for IPsec VPN connections, sending reverse-shell callbacks to three IKE VPN endpoints. CISA added CVE-2026-33824 to its Known Exploited Vulnerabilities catalog on 18 August. Microsoft patched it back in April, which means every organisation still exposed to it in August had five months to act before this actor’s activity gave the flaw fresh urgency.
Why this changes the calculus for self-hosted tools
Citrix NetScaler, Langflow, Marimo and n8n are not niche software. NetScaler sits at the network edge of a large share of European corporate VPN and application access, and Langflow and n8n have become default choices for teams building internal AI and automation workflows quickly. What this campaign demonstrates is that the effort required to turn a known CVE into a working exploit against any one of these tools has collapsed. An attacker no longer needs deep protocol expertise for every target, an AI agent can research and adapt the exploit itself once pointed at an exposed instance. Patch cadence, exposure of admin interfaces to the public internet, and whether IKE-based VPN endpoints are actually necessary all move from “should get to it” to “check this week.”
What to check now
Confirm Windows systems offering IKEv2 or IPsec VPN access are patched against CVE-2026-33824, and review whether any self-hosted Citrix NetScaler, Langflow, Marimo or n8n instances are reachable from the public internet without good reason. If any of those tools are exposed, treat them as a live target rather than an assumption, since this campaign shows exposure alone is now enough to draw automated attention.
If your organisation needs help auditing which self-hosted DevOps and AI tools are internet-exposed, or wants a second opinion on which AI providers and agent frameworks are safe to build automation on top of, contact Excello Digital. We help European businesses close the gap between what they think is exposed and what an autonomous attacker can actually reach.