Why it matters
Unit 42 recovered configuration and session logs after a Chinese-speaking operator's Hermes Agent accidentally exposed its own workspace. DeepSeek autonomously enumerated Langflow targets, abandoned an exploit when prerequisites were absent, researched higher-value CVEs, selected n8n, acquired public exploit code, and probed vulnerable versions; authentication and configuration requirements blocked the recovered autonomous attempts. Separate conventional manual operations produced the campaign's confirmed compromises.
My takeaway: Separate evidence of autonomous attack attempts from successful compromise when assessing AI-enabled threats. Here, ordinary controls—authentication and safer target configuration—stopped the recovered agent runs. Prioritize exposed-service inventory and patching, detect automated enumeration and public-PoC acquisition, retain tamper-resistant agent and tool telemetry, scope targets and tools, rate-limit activity, and monitor unattended agents for both offensive actions and operator-security mistakes.