DeepSeek as attack operator: when the AI agent decides its own targets
On August 5, 2026, CISA added three vulnerabilities to its Known Exploited Vulnerabilities catalog with a 48-hour FCEB remediation deadline. Two of them, CVE-2026-9198 in Langflow and CVE-2026-34486 in Apache Tomcat, share something unusual in common: a single Chinese threat actor, operating under the aliases knaithe and KnYuan, used an AI agent to find, target, and exploit them autonomously across 460+ internet-exposed servers. The AI did not simply automate a fixed script. It made strategic decisions that its operator did not make.
What happened
SOCRadar discovered an exposed staging server controlled by knaithe/KnYuan. The server contained reconnaissance lists, nine weaponized CVEs, a cracked Chinese version of Cobalt Strike known as GoCobaltStrike, tunneling tooling, and attack payloads. The attack infrastructure used the Hermes Agent framework as its orchestration layer: Hermes provided terminal access, Telegram-based command and control, and a modular skill system. DeepSeek served as the reasoning engine, responsible for target selection, vulnerability assessment, and code generation.
The campaign confirmed 16 root-level cPanel and WHM takeovers via CVE-2026-41940 and one Domain Admin compromise via ProxyShell. The sheer volume of targeting analysis, which would take a human operator hundreds of hours, was completed in minutes by the model.
How the AI made attack decisions
Here is the part that changes the threat model. When the AI encountered hardened Langflow deployments where its initial exploits failed, it did not stop or wait for operator input. It identified alternative attack vectors autonomously, pivoting to vulnerabilities in n8n, a workflow automation platform, and other higher-value targets. The operator did not issue a new instruction. The model evaluated the situation and selected a new path.
MITRE ATLAS classifies this under AML.T0043 (craft adversarial data) and the broader pattern of AI-assisted adversarial automation. The decision logic, target scoring, and exploit selection were performed by the reasoning model, not by the human operator watching a Telegram channel. That is a structural change in how quickly and cheaply a skilled attacker can saturate a target list.
What defenders need to do right now
Three patches with a hard August 7 FCEB deadline are on the table. CVE-2026-9198 in Langflow (CVSS 9.8) requires upgrading to version 1.10.1 or later. CVE-2026-34486 in Apache Tomcat (CVSS 7.5) requires upgrading to 10.1.42, 11.0.7, or 9.0.107. CVE-2026-18556 in N-able N-central (CVSS 8.2) requires upgrading to version 24.4 or later. If you are running any of these products and they are internet-exposed, patch now, before the August 7 deadline.
Beyond the immediate patches: the enumeration pattern of this campaign moves faster than most SIEM alert thresholds. If your detection rules are tuned to flag human-paced reconnaissance, they will miss AI-accelerated scanning. Review your rate-based rules for Langflow, Tomcat, and n8n endpoints.
The structural shift
The knaithe/KnYuan campaign is not unique in using AI tools. Threat actors have used AI for phishing copy, translation, and code generation for two years. What is different here is unsupervised decision-making on targeting. The AI chose its next target independently. This changes the required defender posture: you can no longer rely on human cognitive limitations as a natural rate limit on attacker operations. If the model can work without sleep, without breaks, and without second-guessing itself on 460 targets simultaneously, your detection and response pipeline needs to match that pace.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you want to discuss AI-enabled attack detection in your environment.