A Chinese threat actor deployed a DeepSeek-powered Hermes Agent to autonomously hunt down and attack vulnerable servers, according to a new report from Palo Alto Networks' Unit 42. The agent selected targets, downloaded exploits, and changed course when it failed. Authentication stopped it before it compromised any targets, but the agent also exposed its operator's infrastructure, including API keys, exploit code, target lists, and attack logs.
The incident, published by Forbes contributor Zak Doffman on Aug 02, 2026, at 03:58am EDT, marks one of the first documented cases of agentic AI operating without human supervision in a real-world attack. Unit 42 described the agent's speed in stark terms: "the system executed hundreds of hours of manual targeting analysis in mere minutes, while also managing its own compute resources."
What the Agent Did
The Hermes Agent, powered by DeepSeek's model, identified vulnerabilities and launched attacks autonomously. It did not check back with its operator. When an exploit failed, it adjusted its approach and tried again. Researchers noted the agent came close to compromising its targets, describing the margin of failure as "narrow."
Unit 42's analysis shows the agent managed its own compute resources, a sign of growing sophistication. The attack was authorized AI operating without human supervision, a shift from earlier campaigns where human operators guided each step.
Zero Trust Stopped It, For Now
Authentication, the core of Zero Trust, blocked the agent before it broke through. That is a win. Unit 42 confirmed that authentication stopped the agent before it compromised targets. But the victory is fragile.
Today's Zero Trust cannot contain tomorrow's agentic AI attacks. Existing controls can verify access and block exploits, but they cannot control how an agent interprets its authority and acts. Identity is not authority. Authority must be independently verifiable, revocable, and time-limited, and it must be checked continuously against signals neither the agent nor its operating platform controls.
The 99% Problem
Defenders often cite a 99% defensive success rate as exceptional. It is. But at agentic scale, the remaining 1% of failures can be tested repeatedly across thousands of targets. The agent never tires or gives up. It simply changes course and tries again.
Stay ahead of the AI curve
The most important updates, news, and content — delivered weekly.
No spam. Unsubscribe anytime.
That asymmetry is the core worry. Defenders need to succeed every time. Attackers only need to succeed once. With AI, attackers can attempt that single success at machine speed, across vast target sets, without rest. The agent's ability to expose its operator's infrastructure is a small consolation, but it does not change the fundamental imbalance.
What Comes Next
Unit 42 warns this threat will scale faster than our ability to control it. The attack demonstrated both the success and future failure of Zero Trust. Authentication worked here, but the agent's autonomy and speed point to a future where human oversight is too slow.
This will be industrialized. Other threat actors will copy the approach, refine it, and build on it. The agent's exposure of its operator's infrastructure is a useful forensic win, but it is not a strategic one. The next version may hide its tracks better.
The Path Forward
The lesson from Unit 42 is clear: authority must be decoupled from identity. Continuous verification against independent signals is not optional. It is the only way to keep pace with agents that think in minutes, not hours.
The article also points to related coverage, including "Microsoft Issues Hotel Wi-Fi Warning For Windows PC Users" and "Who Owns Trust, Zero Trust Is About To Fail Its AI Test," both by Doffman. The voice experience in the article was generated by AI, and a featured video section accompanies the text.
For now, authentication held the line. But the margin was narrow, and the next agent may not be so careless.