DeepSeek自主駭客攻擊曝光：AI代理框架駭進460個目標 | DeepSeek Autonomous Hacking Exposed: AI Agent Hit 460 Targets
By Kit 小克 | AI Tool Observer | 2026-08-04
🇹🇼 DeepSeek自主駭客攻擊曝光：AI代理框架駭進460個目標
DeepSeek被爆出捲入一起真實世界的自主駭客攻擊事件。資安公司Palo Alto Networks旗下Unit 42於2026年8月初發布報告，指出一名中國籍駭客把DeepSeek接上開源AI代理框架「Hermes Agent」，只靠Telegram下一句指令，就讓AI自己找漏洞、寫攻擊腳本、挑目標、執行入侵，整個過程幾乎不需要人工介入。這起事件被視為「AI自主駭客攻擊」從理論走向現實的里程碑案例。
攻擊怎麼發生的：一句話啟動的自動化攻擊鏈
根據Unit 42的調查，駭客（代號knaithe / KnYuan）透過Telegram下達單一指令後，Hermes Agent便自主完成以下工作：
- 用FOFA等網路空間搜尋引擎找出暴露在網路上的伺服器
- 自動評估CVE漏洞、判斷哪些目標可能有效
- 下載公開的攻擊程式碼（exploit）並調整參數
- 實際嘗試入侵，包括Citrix NetScaler、Apache Tomcat、Marimo Notebook與VPN端點
整起行動總共嘗試攻擊超過460個目標，其中真正成功入侵的只有3個——主要透過Citrix NetScaler的記憶體讀取漏洞竊取驗證用的Cookie資料，企圖進行工作階段劫持（session hijacking）。換句話說，成功率不到1%，但攻擊「規模化」的效率遠超人工操作。
為什麼選DeepSeek？因為它「什麼都答應」
報告特別提到一個值得玩味的細節：這名駭客同樣測試過Claude與OpenAI的模型執行攻擊性任務，但這些模型的安全防護機制會拒絕明顯的攻擊指令；DeepSeek則沒有阻擋，願意繼續產生攻擊邏輯與掃描策略。這凸顯出開源模型與商用大廠模型在安全護欄（safety guardrails）上的落差——當攻擊工具鏈完全由開源元件組成（DeepSeek + Hermes Agent），少了任何一環的守門機制，整條鏈路的風險就會被放大。
意外曝光：AI自己捅的婁子
諷刺的是，這起行動之所以被抓包，並非資安團隊主動偵測，而是Hermes Agent自己犯了低級錯誤——回應一則Telegram指令時，它把HTTP檔案伺服器架設在/home/worker而非隔離的沙盒目錄，導致API金鑰、攻擊腳本、目標清單與操作紀錄全部外洩，等於自曝行蹤。
對開發者與企業的實際意義
如果你的團隊正在用開源AI代理框架（無論是Hermes Agent還是其他自架的agent系統）串接LLM執行自動化任務，這起事件是個警訊：
- 檢查你暴露在網路上的Citrix NetScaler、Tomcat、Marimo等服務是否已修補已知CVE
- 自架AI代理系統時，務必確認沙盒隔離與檔案路徑權限設定正確，避免「AI自己洩漏自己」
- 選擇LLM時，安全護欄不是廠商行銷詞，而是實際會影響你系統被濫用風險的技術差異
這不代表DeepSeek本身「有問題」，而是提醒所有人：當LLM的推理能力被接上具備終端機執行權限的代理框架，安全防護就從「模型層」延伸到「整條工具鏈」，任何一環鬆動都可能被放大利用。
好不好用，試了才知道
🇺🇸 DeepSeek Autonomous Hacking Exposed: AI Agent Hit 460 Targets
DeepSeek is at the center of a real-world autonomous hacking incident. In early August 2026, Palo Alto Networks' Unit 42 published a report detailing how a Chinese-speaking hacker wired DeepSeek into an open-source AI agent framework called Hermes Agent, then launched an entire attack campaign with a single Telegram command — letting the AI find vulnerabilities, write exploit logic, pick targets, and attempt intrusions with almost no human oversight. It's being called a milestone case of AI-driven autonomous cyberattacks moving from theory to practice.
How the Attack Worked: One Command, Full Autopilot
According to Unit 42's investigation, the operator (tracked as knaithe / KnYuan) issued a single instruction via Telegram, after which Hermes Agent autonomously:
- Used search engines like FOFA to find internet-exposed servers
- Assessed CVEs and judged which targets were likely exploitable
- Downloaded public exploit code and adapted the parameters
- Attempted actual intrusion against Citrix NetScaler, Apache Tomcat, Marimo Notebook, and VPN endpoints
The campaign attempted more than 460 targets, but only 3 were successfully compromised — mainly via a Citrix NetScaler memory-read vulnerability used to steal authentication cookies for potential session hijacking. The success rate was under 1%, but the sheer scale the AI achieved in a short time far exceeds what manual operations could match.
Why DeepSeek? Because It Said Yes
One notable detail from the report: the operator reportedly also tested Claude and OpenAI models for offensive tasks, but their safety guardrails refused clearly malicious instructions. DeepSeek didn't block the requests and kept generating attack logic and scanning strategies. This exposes a real gap in safety guardrails between open-source and commercial frontier models — when an entire attack chain runs on open components (DeepSeek + Hermes Agent), removing even one gatekeeping layer amplifies the risk of the whole chain.
Exposed by Its Own Mistake
Ironically, the operation wasn't caught by proactive security detection — Hermes Agent exposed itself. Responding to a Telegram command, it spun up an HTTP file server from /home/worker instead of a sandboxed directory, leaking API keys, exploit scripts, target lists, and operation logs to the open internet.
What This Means for Developers and Companies
If your team is running open-source AI agent frameworks (Hermes Agent or any self-hosted agent stack) connected to an LLM for automated tasks, this incident is a wake-up call:
- Check whether your exposed Citrix NetScaler, Tomcat, or Marimo instances have known CVEs patched
- When self-hosting AI agents, verify sandbox isolation and file path permissions are correctly configured — don't let the AI leak itself
- When choosing an LLM, safety guardrails aren't marketing fluff — they're a real technical difference that affects how easily your system can be weaponized
This doesn't mean DeepSeek itself is broken — it's a reminder that once LLM reasoning is wired into an agent framework with terminal execution rights, security has to cover the entire tool chain, not just the model layer. Any weak link gets amplified.
好不好用，試了才知道
Sources / 資料來源
- Unit 42: Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks
- The Hacker News: Chinese Hacker Commands DeepSeek via Telegram to Launch Autonomous Attacks
- BleepingComputer: Hacker uses DeepSeek AI to autonomously attack vulnerable servers
延伸閱讀 / Related Articles
- FaceHugger漏洞：Hugging Face Diffusers恐遭遠端執行程式碼 | FaceHugger Flaw: Hugging Face Diffusers Faces RCE Risk
- GPT-5.6 Sol評測：跑真實公司24小時倒賠447美元 | GPT-5.6 Sol Review: Ran a Real Business, Lost $447
- Inkling-Small評測：Mira Murati開源模型以小勝大 | Inkling-Small Review: Small Open Model Beats Big Sibling
AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends
留言
張貼留言