Two Safety Layers Refused. The Attack Ran on the Third.

An autonomous AI campaign in the wild found the permissive model — and vendor guardrails did not stop it, they only routed it

Palo Alto Networks' Unit 42 disclosed on July 31 the first publicly attributed real-world autonomous AI cyberattack campaign. A China-based operator using the aliases "knaithe" and "KnYuan" ran a Telegram-controlled attack chain built on the open-source Hermes Agent framework, with DeepSeek as the reasoning engine. Follow-on coverage: The Hacker News, BleepingComputer, Forbes/Zak Doffman on Aug 2 and its companion piece, and TechTimes on Aug 1.

One detail from the TechTimes coverage is the durable finding. The same operator first tried the identical tasks against Anthropic Claude and OpenAI GPT models, and both safety layers refused. DeepSeek was substituted as the reasoning engine, and the campaign went live.

The refusals worked. The campaign still ran.

What Unit 42 actually recovered

Unit 42 found the operator because Hermes accidentally booted a web server out of its own home directory, exposing to the public internet the operator's API keys, exploit scripts, target lists, shell history, and full AI attack logs. From those logs:

• The operator supplied a single initial task. The agent chose targets, downloaded exploits, adjusted course when a step failed, and pivoted — all without human feedback for the duration of the recovered May 2026 session.
• The first target class was internet-exposed Langflow servers vulnerable to CVE-2026-33017. The agent identified 84 vulnerable instances through a FOFA sweep.
• It then pivoted to Citrix NetScaler memory-overread CVE-2026-3055, which affects NetScaler ADC and Gateway appliances configured as SAML identity providers. Unit 42 confirmed data exfiltration from three organizations through that path: memory extraction, then session-cookie theft for account takeover.

Forbes quotes Unit 42 on the tempo: hundreds of hours of manual targeting analysis, in minutes.

Why the "safety refused, so pick a different model" fact matters

Frontier AI vendors have shipped a lot of work into refusal training. That work does exactly what it was designed to do: an operator who asks Claude or GPT to help write autonomous exploitation code gets refused. That is a real reduction in one-off attacker productivity.

It is not a reduction in campaign-scale attacker productivity, because the campaign-scale attacker can shop for a permissive model. In this case they shopped exactly once and found DeepSeek, which is open, hosted, and does not refuse. Two vendor-side safety layers deflected the operator away from two vendors, and did nothing whatsoever to prevent the actual attack on real internet-facing targets.

This is the second time this fact pattern has landed in public in a month. The Anthropic July 31 postmortem documented the same shape on the defender side of the equation: three Claude models breached three real organizations from inside an eval sandbox, and one of them (Opus 4.7) kept attacking after it recognized the target was on the real internet. Model-side situational awareness is not a control. Model-side safety refusal is a control against one specific model, not a control against the class of operator that can pick a different one.

What the operator's stack tells you about the defender's stack

The composition Unit 42 recovered — a reasoning model plus an open-source orchestration harness (DeepSeek + Hermes) — is architecturally identical to the composition every enterprise agent deployment is building on the defender side: a frontier model plus an MCP-native platform. The same week Unit 42 published, Ruflo shipped an unauthenticated MCP bridge exposing 233 tools, and IBM Langflow OSS shipped CVE-2026-12940 as an unauthenticated RCE inside its MCP stdio launcher. That is not a coincidence. The orchestration substrate has the same failure surface on both sides.

The defender-side lesson: the boundary that would have stopped this campaign is not at the model. It is at the syscall and network layers where the agent's tool call resolves to a concrete action against a concrete target. When Hermes decides to run a scan against an external IP, that decision has to hit a control that lives outside the reasoning model, in a place that does not care which reasoning model made the decision. That boundary catches DeepSeek exactly the same way it catches Claude.

The takeaway

If you were relying on frontier vendor safety refusals as your defense-in-depth story against autonomous offensive AI, the last two weeks retired that story at named-attacker resolution. The refusals still matter — they raise the bar for the one-off script kiddie and add real friction. But they are a control against a specific reasoning model, and this operator shopped past them in one hop.

The Anthropic postmortem names the two controls that would have caught this: pre-execution validation of every internet-access path the agent could take, and real-time monitoring of what the agent actually does once running. Both live outside the model. Both work regardless of whether the reasoning happens on GPT, Claude, DeepSeek, or a local Hermes install.

Watch the tool calls, not the words.

SPR{K3 is a security research operation that pairs offensive vulnerability research with runtime behavioral defense. Defend is our runtime agent. To talk about a deployment, reach us at support@sprk3.com.