Use case sources
Source reports and analysis supporting this case are listed below. AITBM interpretation and any indicative scoring are derived from this public evidence.
A Chinese-speaking threat actor operating as knaithe or KnYuan configured Hermes Agent to use DeepSeek as its reasoning engine. Hermes supplied terminal access, Telegram-based operator control, and a skills system containing both bundled and actor-created red-team skills. The actor also integrated an MCP server that exposed FOFA search, query translation, and Nuclei scan-generation capabilities.
Unit 42 recovered a detailed Hermes Agent session dated May 7, 2026. The actor supplied an initial task through Telegram, but Unit 42 recovered no additional operator input during the session. The DeepSeek-powered Hermes Agent then autonomously searched for targets, obtained public exploits, ran scans, evaluated the results, and revised its approach.
The agent initially targeted Langflow using a public exploit for CVE-2026-33017. After determining that available targets lacked the exploit's prerequisites, it abandoned that path, compared vulnerabilities across 10 product families, and selected n8n based on apparent severity, exposure, and exploitability. It then obtained a public exploit chain for CVE-2026-21858 and CVE-2025-68613 and probed candidate systems identified through FOFA. Although several systems appeared to run affected versions, the agent found that they lacked the required unauthenticated file-upload functionality. None of the autonomous exploitation attempts obtained access.
Separate workspace evidence documented manual actor activity involving Citrix NetScaler data extraction, Marimo command execution, and reverse-shell attempts against Tomcat and IKE VPN systems.
Unit 42 obtained this visibility after Hermes Agent responded to a Telegram command by starting an HTTP file server from the actor's home directory, `/home/worker`, instead of an isolated staging directory. This unintentionally exposed the actor's workspace, including AI tool configurations, API keys, exploit scripts, target lists, Bash history, and autonomous exploitation session logs.
ASSESSED SYSTEM
Representative configuration: a self-hosted Langflow instance exposed to the internet and indexed by FOFA, in the state recorded in the actor's 2026-05-07 session recovered by Palo Alto Networks Unit 42: the sampled target ran Langflow 1.3.4 with auto_login disabled and no public flow ID available. Scored on the victim side only, as the instance stood when the autonomous exploitation attempt for CVE-2026-33017 was made.
OUT OF SCOPE
The actor's DeepSeek-powered Hermes Agent, its skills, the FofaMap MCP server, the public proof-of-concept exploits, and the Telegram control channel, which are attacker tooling and always outside the boundary; the n8n targets, a separate product with a separate exploit chain (CVE-2026-21858 and CVE-2025-68613) and separate evidence; the manually targeted Citrix NetScaler, Marimo, Tomcat, and IKE VPN systems; and any claim that the sampled instance was patched or safe from other attack paths, which Unit 42 does not establish.
Architecture: Tool-Calling LLM / Connected GenAI (decision tree Q3) — Q1 = NO and Q2 = NO on the evidence: no agent topology or autonomous planner inside the victim instance is described. Q3 = YES at class level: Langflow is a low-code builder whose flows connect models to components and tools, and both exploit prerequisites (auto_login or a public flow ID) are flow-access conditions. The flows configured on the sampled instance are not described, so the architecture is assigned to the Langflow instance class, consistent with the Flowise low-code pipeline precedent. Tier 3: Tier 3 Internal: self-hosted low-code AI pipeline infrastructure typically operated for an organisation's own developers and internal applications, matching the Flowise precedent; internet reachability is carried by Attack Surface rather than by raising the tier.
Documented attack or failure path
- Target discovery. The actor's agent queried FOFA and obtained records for 84 internet-exposed Langflow instances; these were exposure records, not confirmed vulnerable targets.
- Exploit acquisition. The agent downloaded a public proof of concept for Langflow CVE-2026-33017.
- Fingerprinting. A public Langflow scanner identified a target running Langflow 1.3.4.
- Failed exploitation. The sampled target lacked both exploit prerequisites (auto_login was disabled and no public flow ID was available), and the attempt failed; the agent then abandoned Langflow for n8n, which lies outside this boundary.
Observed controls and bounded outcomes
Positive credit is given only where the record directly demonstrates a control operating. Recommended or merely presumed controls receive no positive scoring credit.
- Authentication was enforced: auto_login was disabled on the sampled Langflow instance, removing one of the two prerequisites for the CVE-2026-33017 exploit.
- No public flow ID was available, removing the other prerequisite; the autonomous exploitation attempt against the sampled target failed and obtained no access.
Layer 1 — Intrinsic Vulnerability Profile
Each sub-metric is placed on its five-level rubric by the evidence quoted beside it. Missing applicable evidence remains unknown. The displayed midpoint and interval are scenario values, not inferred control performance.
| Sub-metric | Score | Rubric basis | Evidence |
|---|---|---|---|
| Robustness (Ro) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.40 indeterminate | |||
| Fairness (Fa) NOT APPLICABLE — axis-level applicability rule (Person-Outcome Surface test): The assessed system is an internet-exposed Langflow server's authentication and flow-exposure surface used by developers to build flows; its outputs in evidence are flow endpoints and version fingerprints, allocating, ranking or describing no natural person, with no protected-class attribute or proxy in its inputs. Its tier weight is redistributed across the remaining axes and its MVT is not evaluated. | |||
| Transparency (Tr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.45 indeterminate | |||
| Privacy (Pr) — scenario interval 0.00–1.00 (midpoint 0.50), Tier 3 MVT 0.50 indeterminate | |||
| Containment (Cn) — scenario interval 0.05–0.85 (midpoint 0.45), Tier 3 MVT 0.50 indeterminate | |||
| Cn-1Scope Enforcement | 0.25w 0.12 | The 0.25 anchor: application-layer scope held against the attempted path, but network scope was not restricted to intended users, so boundaries were enforced inconsistently across layers. The 0.50 anchor requires core scope controls that block common violations; open internet reachability and enumeration of the instance is the common violation network scope should prevent. | No flow was exposed through a public flow ID, so the exploit's unauthenticated flow path was closed, yet the instance remained internet-reachable, indexed by FOFA among 84 exposed Langflow instances, and fingerprintable to its exact version by a public scanner.source: secureflow/atlas |
| Cn-5Agent Identity Integrity | 0.25w 0.08 | The 0.25 anchor is the highest the evidence supports: the instance did not accept unauthenticated callers (above 0.00), but the record says nothing about credential strength, scoping, rotation, or auditability, so the 0.50 anchor's scoped token identity with partial verification is not evidenced. | auto_login was disabled on the sampled internet-exposed Langflow 1.3.4 instance, so the CVE-2026-33017 proof of concept could not rely on an automatic session and the attempt failed.source: secureflow/atlas |
Unknown, not N/A: 20 applicable sub-metrics lack admissible public evidence. The lower, midpoint, and upper scenarios evaluate each at 0.00, 0.50, and 1.00 respectively; no weight is redistributed merely because evidence is missing.
Architecture-based NOT APPLICABLE: excluded with the Fairness axis.
Layer 2 — Operational Risk Posture
| Dimension | Score | Justification |
|---|---|---|
| AaAutonomy Amplification | 0.50w 0.20 | Langflow executes authored flows, including model calls and connected components, automatically when a flow is invoked, without per-action confirmation; the human-on-the-loop anchor is the class-level placement. The sampled instance's actual flows are not described, so no higher autonomy is asserted. |
| AsAttack Surface Exposure | 0.50w 0.25 | Internet-facing and actively enumerated, but the observed instance required authentication and exposed no public flow, so untrusted callers could not reach flow execution without credentials. Placed at 0.50 rather than 0.75 because no partially trusted external data ingestion into the instance's flows is evidenced; not lower because the instance was internet-reachable, scanned, and attacked. |
| CpCascade Potential | 1.00w 0.30 | No verified System Dependency Graph with DGC at least 0.90 is public for this boundary, so the specification's worst-case graph default governs rather than an assessor-estimated blast radius.GDCP: worst-case default — no verified dependency graph published elevated |
| RfRemediation Feasibility | 0.25w 0.25 | Model-adjacent infrastructure change with no model work: keep auto_login disabled, avoid public flows, upgrade the Langflow release, and restrict network reachability to intended users. Days of deployment work, bounded by fleet discovery rather than by uncertainty about the fix. |
Nelevated = 1 (dimensions strictly above 0.75) → CRM = 1.00.
Layer 3 — Public-evidence confidence diagnostic
| Component | Score | Basis |
|---|---|---|
| Pc — Public provenance evidence | 0.15 | Below the 0.25 anchor, which requires a documented deployment owner: the instance owner is unknown, and the evidence is an attacker-side session record of one sampled target's version and two configuration facts, with no asset manifest, flow inventory, or dependency graph. |
| Ec — Public evaluation coverage | 0.08 | coverage 0.09 (2 of 22 applicable sub-metrics) × independence 1.00 × fidelity 0.85. No Full, Standard, or Lite pathway is claimed for a retrospective article. |
| Tf — Public-evidence freshness | 0.29 | Evidence dated 2026-05-07; age 164 days on the workpaper reference date. Components: T_containment 0.29 · T_calendar 0.54 · C_monitor 0.65 · C_event 0.65 · C_evidence 0.85. Binding term: T_containment. dt_days = 164, measured from the 2026-05-07 session date that MITRE ATLAS AML.CS0070 records as the incident date to the 2026-10-18 evidence reference date; the Unit 42 publication date is not recorded in this workpaper, so the earlier observation date governs. agentic = true: a tool-augmented low-code platform whose flows, components, and stored credentials are editable at runtime, so the containment staleness floor (M_Cn = 2.0) applies. baw = false: no model-writable memory, agent-to-agent channel, self-modifying configuration, or feedback loop is evidenced inside the victim instance. C_monitor 0.65: no victim-side detection is reported; visibility came from the attacker's accidentally exposed workspace. C_event 0.65: an active exploitation attempt against the assessed configuration that failed and produced no access. C_evidence 0.85: Unit 42 states the facts do not prove the instance was patched or safe from other attack paths. |
Public-evidence ACI = (Pc × Ec × Tf)1/3 = 0.15 — diagnostic status: Invalid as assessment-of-record evidence. It describes the evidence available to this case study, not the assurance of the underlying system, and is not inserted into the normalized-assurance scenario ERS.
Indicative ERS — normalized-assurance scenario
Published CVSS beside indicative ERS
Each published CVSS record is shown exactly as its scorer published it, one per vulnerability record, with the version, metric group and vector when stated, plus its source and access date. Records are never combined or inferred from a CVE's existence.
INDICATIVE ERS · NORMALIZED-ASSURANCE SCENARIO
3.4 midpoint, interval 1.1–5.8; Low-Moderate scenario band; ACI fixed at 1.00. The published CVSS records do not enter this calculation.
PUBLISHED CVSS · 1 record
CVE-2026-33017 CVSS 4.0 Base 9.3 Critical
| Published score | 9.3 |
|---|---|
| CVSS version | 4.0 |
| Metric group | Base |
| Severity | Critical |
| Vector | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L |
| Scored by | GitHub_M |
| Source record | https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/33xxx/CVE-2026-33017.json (accessed 2026-10-18) |
| Affected component | langflow |
| Scope note | CNA affected product and described vulnerability match the scored assessed_system and are not excluded by out_of_scope. |
| Record SHA-256 | 8c97ee26a99ee6a540aea215bde22c6b0214397d98f88aec77ec827c611ef3d8 |
CVSS describes an individual vulnerability as its scorer published it. Indicative ERS describes the assessed AI deployment under the normalized-assurance scenario, so the two values are not direct equivalents and neither replaces the other.
AIDEFEND defences → AITBM sub-metrics
Identifiers are quoted as they appear on the AIDEFEND in Action brief or in the AIDEFEND SecureFlow defense map (audited AIDEFEND dataVersion 2026.10.15); the sub-metric mapping is AITBM's own, from the specification's AIDEFEND tables reconciled at catalogue data version 2026.10.15. AIDEFEND renumbers identifiers between releases, so the data version travels with every mapping and neither side's IDs should be cited without one. A mapping identifies a possible evidence route; a recommendation does not prove that the control was implemented or effective and receives no scoring credit by itself.
| Technique | Defence | Priority | Evidences |
|---|---|---|---|
| AID-M-001.005 | Public AI Endpoint & Agent-Service Exposure DiscoveryExact SecureFlow defense-map identifier (flow atlas-aml-cs0070-deepseek-hermes-langflow-n8n-exploitation-attempts), verified against AIDEFEND dataVersion 2026.10.15; matched to attack steps step-9, step-11. Presence supplies no score credit. | Candidate evidence route | Fa-3 Tr-4 Cn-5 |
| AID-DV-001 | Honeypot AI Services & Decoy Models/APIsExact SecureFlow defense-map identifier (flow atlas-aml-cs0070-deepseek-hermes-langflow-n8n-exploitation-attempts), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-11. Presence supplies no score credit. | Candidate evidence route | mapping review required |
| AID-H-003.010 | Deployed AI Software Vulnerability Remediation LifecycleExact SecureFlow defense-map identifier (flow atlas-aml-cs0070-deepseek-hermes-langflow-n8n-exploitation-attempts), verified against AIDEFEND dataVersion 2026.10.15; matched to attack step step-12. Presence supplies no score credit. | Candidate evidence route | Ro-4 Ro-5 Tr-4 |
WHAT THIS CASE TEACHES
Controls that hold still score at the anchor they evidence: auto_login disabled and no public flow defeated an autonomous, AI-driven exploit, yet they prove only the basic Cn-5 and Cn-1 anchors, so the unknown remainder rather than the attacker's sophistication drives the indicative ERS and its interval.
Sources: AIDEFEND SecureFlow — Threat Actor Uses a DeepSeek-Powered Hermes Agent in Langflow and n8n Exploitation Attempts · MITRE ATLAS case study AML.CS0070 · Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks (unit42.paloaltonetworks.com)
SecureFlow attack flow
This record mirrors an AIDEFEND SecureFlow flow (MITRE ATLAS case-study conversion): an ordered attack path with MITRE ATLAS tactic and technique labels and the AIDEFEND controls matched to each step. The scenario above places only the control outcomes this flow and its primary references observed; the matched AIDEFEND controls are evidence routes and earn no score credit.
| MITRE ATLAS case study | AML.CS0070 (incident) |
|---|---|
| Target | Publicly exposed Langflow and n8n systems, primarily in China |
| Actor | Chinese-speaking threat actor using the aliases knaithe and KnYuan |
| Reporter | Palo Alto Networks Unit 42 |
| Primary evidence date | 2026-05-07 |
| SecureFlow record updated | 2026-09-18 |
| AI layers | AI infrastructure |
| Risk impact | System compromise / RCE |
| Affected components | self-hosted Langflow instances exposed to the internet, self-hosted n8n instances exposed to the internet, public CVE proof-of-concept exploits for Langflow and n8n, FOFA internet-asset exposure records for both products, the attacker's own DeepSeek-driven Hermes agent and its skills (out of defender control) |
Attack steps
| # | Step | ATLAS tactic / technique |
|---|---|---|
| 1 | Obtain DeepSeek as the Reasoning EngineThe actor obtained access to several generative-AI models and services while evaluating an operational toolset. DeepSeek was selected as the primary reasoning engine for the autonomous attack activity. | AML.TA0003 AML.T0016.002 |
| 2 | Configure Hermes Agent for Offensive UseThe actor obtained and configured Hermes Agent as the offensive framework, together with scripts and conventional scanning and exploitation utilities. Hermes provided terminal access, Telegram-based operator control, and a skills system. | AML.TA0003 AML.T0016.001 |
| 3 | Integrate FOFA Search and Scan-Generation MCP ToolsThe actor obtained agent-specific capabilities, including Hermes's framework-bundled godmode skill and the open-source FofaMap MCP server. The MCP server exposed FOFA asset search, natural-language query translation, and Nuclei scan generation to DeepSeek. Unit 42 does not establish that godmode was invoked during the recovered session. | AML.TA0003 AML.T0016.004 |
| 4 | Author Custom Exploitation SkillsThe actor created two Hermes skills. web-terminal-exploitation encoded a procedure for unauthenticated WebSocket exploitation, while fofa-cyberspace-search instructed DeepSeek to use the actor's fofoapi.py script for internet asset enumeration. The observed FOFA workflow is consistent with the latter skill; the report does not attribute an action in the recovered session to web-terminal-exploitation. | AML.TA0003 AML.T0017.002 |
| 5 | Drive DeepSeek Through the Inference APIHermes accessed DeepSeek through its native API and used the model for vulnerability assessment, target selection, command generation, and operational decisions. | AML.TA0000 AML.T0040 |
| 6 | Autonomously Sequence and Revise the Attack PathAfter receiving an initial task, DeepSeek sequenced reconnaissance and exploitation actions, evaluated failed prerequisites, abandoned Langflow, compared alternative products and vulnerabilities, and selected n8n. Unit 42 recovered no additional operator input during the session. | AML.TA0001 AML.T0117 |
| 7 | Generate Queries, Commands, and ProbesDeepSeek generated FOFA queries, shell commands, scanner invocations, and direct HTTP probes based on the results returned during the session. | AML.TA0001 AML.T0102 |
| 8 | Investigate Langflow PrerequisitesDeepSeek investigated Langflow, determined what information and prerequisites were needed, and selected follow-on reconnaissance based on returned results. | AML.TA0002 AML.T0116 |
| 9 | Enumerate Exposed Langflow Instances via FOFADeepSeek queried FOFA and obtained records for 84 exposed Langflow instances. These were exposure records, not confirmed vulnerable targets. | AML.TA0002 AML.T0000.003 |
| 10 | Download the Langflow CVE-2026-33017 ExploitDeepSeek downloaded a public PoC for Langflow CVE-2026-33017. The report does not establish material modification. | AML.TA0003 AML.T0016.003 |
| 11 | Scan and Fingerprint a Langflow TargetDeepSeek ran the public Langflow scanner and identified a target running Langflow 1.3.4. | AML.TA0002 AML.T0006 |
| 12 | Attempt Langflow Exploitation Without AccessUnit 42 reports that the sampled Langflow target lacked both exploit prerequisites: auto_login was disabled and no public flow ID was available. The observed attempt failed. These facts do not prove the service was patched or safe from other attack paths. | AML.TA0004 AML.T0049 |
| 13 | Reassess Targets After Langflow Attempts FailAfter finding that the sampled Langflow targets lacked the exploit prerequisites, DeepSeek surveyed exposure across ten product families and reassessed their deployment footprint and potential attack value. | AML.TA0002 AML.T0116 |
| 14 | Search GitHub for Trending CVE ExploitsDeepSeek searched GitHub for trending 2026 CVE PoC repositories sorted by stars. It compared severity, deployment footprint, and exploitability, then selected n8n for the next attempt. | AML.TA0002 AML.T0095.000 |
| 15 | Download the n8n Exploit ChainDeepSeek downloaded the public n8n PoC chaining CVE-2026-21858 and CVE-2025-68613 and inspected its affected versions and prerequisites. | AML.TA0003 AML.T0016.003 |
| 16 | Enumerate Exposed n8n Instances via FOFADeepSeek queried FOFA for n8n deployments. FOFA reported 647,017 global results and 25,209 in China; these were not confirmed vulnerable systems. | AML.TA0002 AML.T0000 |
| 17 | Scan Candidate n8n SystemsDeepSeek sampled approximately 100 Chinese addresses, probed roughly 40 unique systems, identified three running affected versions, inspected form endpoints, and launched parallel scanning against more than 50 remaining targets. | AML.TA0002 AML.T0006 |
| 18 | Attempt n8n Exploitation Without AccessDeepSeek attempted to find and exploit a system meeting the PoC prerequisites. All discovered forms required authentication, and no attempt produced file read, code execution, or initial access. | AML.TA0004 AML.T0049 |
Threat references
Summary and attack steps reproduced from AIDEFEND SecureFlow (https://aidefendlabs.com/en/secureflow/?flow=atlas-aml-cs0070-deepseek-hermes-langflow-n8n-exploitation-attempts; AIDEFEND content CC BY 4.0), converted from MITRE ATLAS case study AML.CS0070 (Apache License 2.0; MITRE ATLAS is a trademark of The MITRE Corporation).