Chinese AI Used To Launch Attacks—Here’s What Happened Next

Palo Alto Networks’ Unit 42 found that a Chinese threat actor used a DeepSeek-powered Hermes Agent to hunt for vulnerable servers and automate exploit downloads.

The AI agent could adapt when attacks failed, moving faster and more autonomously than a human operator, but authentication controls stopped it before targets were compromised.

The investigation also exposed details of the attacker’s own infrastructure, underscoring how AI-driven operations can leak operational clues.

The case highlights how authorized AI agents can expand the speed and scale of cyberattacks beyond what current controls were designed to handle.

Experts say zero trust may need to evolve to govern not just users, but also the authority and actions of AI agents.