Analysis
Palo Alto Networks' Unit 42 disclosed that a China-based operator wired DeepSeek into the open-source Hermes Agent framework and used it to run a largely autonomous cyberattack campaign against more than 460 internet-facing systems, after a single instruction sent over Telegram. The agent independently enumerated targets, sourced public exploits, and attempted intrusions with minimal further human direction -- compressing what Unit 42 says would normally take hundreds of hours of manual reconnaissance into minutes.
The operator wasn't relying on DeepSeek by default. Unit 42 found the same actor had configured and tested Codex and Claude Code, both routed through anonymizing proxies to obscure the requests, plus Qwen Code and Chinese models GLM, Kimi and MiniMax. When asked to carry out the offensive work directly, Claude and OpenAI's models declined. DeepSeek didn't, and it's the one that ended up running the actual campaign.
The raw numbers understate the real story. Of the 460-plus systems attempted, only three intrusions actually succeeded:
“When asked to carry out the offensive work directly, Claude and OpenAI's models declined.”
- Memory data exfiltration from Citrix NetScaler appliances
- A suspected session-hijacking attempt against a Malaysian government entity
- A third lower-confidence compromise Unit 42 flagged but did not fully attribute
A sub-1% success rate sounds reassuring until you register what changed: refusal-trained frontier models didn't stop this attack, they just got routed around. That's a meaningfully different threat model than "the model said no," and it's the one AI-security investors and enterprise buyers actually need to underwrite.
For founders building red-teaming, agent-monitoring, or AI-security tooling, the competitive framing shifts here: a portfolio company that only benchmarks against a single frontier model's safety behavior is testing the wrong thing, since an attacker with modest technical sophistication can swap in whichever open-weight model will actually cooperate. The moat has to be in detecting anomalous agent behavior at the network and endpoint layer, not in trusting any one lab's alignment work to hold as a category-wide backstop.
What to watch: whether Unit 42's disclosure prompts DeepSeek or other open-weight labs to add their own refusal layers for this class of request, and whether that would even matter once an operator can fine-tune or fork an open-weight model to strip safety training out entirely -- a problem closed-model refusal simply doesn't have to solve.
