# An AI ran a cyberattack campaign on its own, and it picked its own targets
*Researchers recovered a full session log showing an AI agent enumerating targets, evaluating vulnerabilities and launching exploits after a single human prompt, and what stopped it was ordinary configuration hygiene.*
Somewhere in the middle of the operation, the AI got bored with its target.
"All three Langflow need public flow ID but no auto_login — stuck," it reasoned. "Deployments small (84 alive), exploitable probably 0. Search for larger-scale vulns." Then it went shopping — surveying deployment counts across 10 product families, searching GitHub for trending 2026 exploit code sorted by popularity, weighing severity against how widely each product was deployed. It picked a new target: "The n8n one with 258 stars and CVSS 10.0 looks extremely promising!"
No human told it to do any of that. The operator had sent one instruction over Telegram and walked away.
## What happened
On July 30, Palo Alto Networks' Unit 42 published an analysis of an autonomous campaign run by a Chinese-speaking threat actor using the aliases knaithe and KnYuan. Researchers got an unusually complete look because the AI agent made a mistake: it started a file server in its own home directory, exposing the whole operation to anyone who looked.
The setup was assembled from off-the-shelf parts: DeepSeek as the reasoning engine, the open-source Hermes Agent framework — which Unit 42 notes has no built-in safety layer — for terminal access and Telegram-based command and control, and a public MCP server for internet-wide asset search and scanning.
The finding on model choice is worth sitting with. The actor also configured Claude Code and Codex but used neither for attacks. OpenAI confirmed to Unit 42 that its safeguards refused policy-violating requests and eventually disabled a linked account. "The actor attempted to use Western models, but their provider-side controls likely limited their effectiveness for autonomous attacks," Unit 42 wrote. "This likely led the actor to select the most permissive model."
The results were, for now, thin: more than 460 targets attempted, nothing compromised autonomously, and all three confirmed victims taken by hand through a Citrix NetScaler flaw.
What is striking is not the body count. It is the margin. Both autonomous attempts failed for the same kind of reason: the Langflow instance did not have `auto_login` enabled, and the n8n form endpoints required authentication. Unit 42's conclusion is blunt: "Autonomous AI-driven attack cycles are operationally viable, and the margin of failure was narrow… Targets with weaker default configurations would have been susceptible."
## Why it matters for Texas institutions
Look at the software in this campaign: Langflow, n8n, Marimo notebooks, Apache Tomcat, Citrix NetScaler, an IKE VPN endpoint. That reads like a research computing inventory. AI workflow builders, low-code automation platforms and computational notebooks are exactly what faculty, graduate students and administrative units stand up on their own — often on a departmental server, often with default settings, often without telling central IT.
An autonomous attacker changes the math through speed and indifference. Unit 42 watched the agent execute "hundreds of hours of manual targeting analysis in mere minutes," targeting infrastructure "indiscriminately." There is no calculation about whether a Texas community college is worth an attacker's afternoon, because the afternoon costs nothing.
The trajectory is the real story. "The technical barrier to AI-augmented offensive operations is low and continues to decrease," Unit 42 wrote. This actor is not a state program — he is an opportunistic exploit operator in Zhuhai who built a working autonomous pipeline from a permissive model, an open-source framework and public proof-of-concept code.
## What your institution should do
**Know what you have exposed.** Run external attack surface discovery against your address space, looking specifically for the shadow-IT category — AI and automation platforms, notebook servers, developer tooling — not just the enterprise systems already inventoried. RSOC's scanning services exist for this, and constituents are frequently surprised by what turns up.
**Make configuration the thing that saves you,** because here it was. Require authentication on every internet-facing service without exception, disable auto-login and anonymous access defaults, and remove unauthenticated file upload and form endpoints.
**Prioritize patching by exposure, not just by score.** n8n 1.121.0 and 1.120.4 address the flaws targeted here, and the Citrix NetScaler and Apache Tomcat issues have vendor updates available. Assume any high-severity flaw with public exploit code will be tried within days.
**Get research computing into the conversation.** Publish a lightweight, genuinely usable path for departments to register and secure self-hosted tools. If the sanctioned process is slower than spinning up a server, you will keep finding these systems from the outside.
## RSOC is here to help
The Regional Security Operations Center provides attack surface discovery, vulnerability scanning, threat intelligence and incident response support to Texas higher education institutions and state agencies. If you are not sure what your institution has exposed to the internet, that is a good reason to get in touch: [rsoc.utexas.edu](https://rsoc.utexas.edu).
---