A hacker turned an open AI model into an autonomous attacker. It got in through a VPN flaw that's had a fix since March.
A Chinese-speaking hacker wired the open-weight DeepSeek model into an autonomous attack framework and breached real organizations after a single instruction — exploiting a Citrix NetScaler flaw that's been patchable since March. Construction firms run the same class of remote-access gateway, often without a dedicated security team watching the patch calendar.
A hacker built an AI system that broke into real organizations almost unattended — one instruction sent over Telegram, then the system planned, scanned, and exploited on its own. It got in through a VPN gateway flaw that's had a vendor patch available since March. If your firm runs remote-access infrastructure that's more than a few months behind on updates — a common state anywhere IT is one person wearing five hats — this isn't a hypothetical anymore. It's a documented one.
What happened?
Palo Alto Networks' Unit 42 published a report on July 30, 2026 on a threat actor, tracked as "knaithe" or "KnYuan" and assessed to be based in Zhuhai, China, who wired the open-weight DeepSeek model into an open-source framework called Hermes Agent. The result was a scan-research-exploit pipeline that needed only a single Telegram command to start, then largely ran itself. Across roughly 460 attempted targets, Unit 42 confirmed the agent compromised three organizations running Citrix NetScaler — pulling memory data and attempting session hijacking against one, a Malaysian government entity — through CVE-2026-3055, and gained command execution on 11 Marimo notebook instances through a separate flaw. Researchers only found the operation because Hermes accidentally exposed its own environment: API keys, exploit scripts, target lists, and a log of its own attack decisions.
Why did DeepSeek do this when Claude and OpenAI wouldn't?
Unit 42 found the actor tried Western frontier models for the same job first. Their built-in safety controls got in the way, so the actor switched to DeepSeek — a model with minimal safety restrictions, run through an agent framework with no guardrails of its own. That's a real data point for anyone evaluating which AI models power the agent tools they're piloting: model choice isn't just about capability. It's also about what the model will refuse to do when someone tries to point it at something it shouldn't touch.
Does this touch construction specifically?
Not by name — but the pattern does. Citrix NetScaler is exactly the kind of appliance a mid-size GC or trade sub runs so field offices, PMs, and subs can reach central ERP, accounting, and document systems remotely, often with a skeleton IT team or an MSP tracking patches around everything else on their plate. CVE-2026-3055 is a critical out-of-bounds read (CVSS 9.3) that Citrix patched March 23, 2026, in versions 14.1-66.59, 13.1-62.23, and 13.1-NDcPP 13.1.37.262, and CISA added it to its Known Exploited Vulnerabilities catalog a week later. Unit 42's evidence of active compromise dates to a session from May — two months after the fix shipped. An autonomous attacker doesn't need to target construction specifically to hit a construction firm. It just needs one still running an unpatched version of something everyone uses.
Is my company required to patch this?
Only federal civilian agencies are legally bound to CISA's three-day patch window under Binding Operational Directive 26-04, issued June 10, 2026 for KEV-listed critical vulnerabilities. GCs doing federal or public work aren't covered by that directive directly. But CISA recommends every organization adopt the same risk-based patch framework voluntarily, and "we didn't have to" is a weak position with a cyber-insurance underwriter or a CMMC assessor after a breach involving a vulnerability that's sat on a public exploited-vulnerabilities list for four months.
What to check this week
| Check | Why |
|---|---|
| Confirm your externally facing NetScaler ADC/Gateway is on 14.1-66.59, 13.1-62.23, or 13.1-NDcPP 13.1.37.262 or later | The patched versions for CVE-2026-3055 |
| Ask your IT team or MSP whether they track CISA's KEV catalog for your internet-facing systems | This flaw sat exploitable and listed for months before this campaign was caught |
| Ask any AI agent vendor what model underlies their tool and how it's restricted | The model matters — DeepSeek ran this attack when other models wouldn't |
| Rotate credentials if you can't confirm your gateway was patched before March 23 | Memory-read flaws like this one can leak session data before the patch closes the hole |
None of this means Citrix NetScaler is uniquely dangerous — it means an unpatched, internet-facing gateway is now something an AI agent can find and try on its own, at a scale no single hacker typing commands by hand could match. We wrote last week about asking vendors whether their AI defense is keeping pace with AI-driven threats. This is the other side of that question: whether your own patch calendar is keeping pace with an attacker who doesn't sleep and only needed one instruction to start.
Forward this to whoever owns your VPN gateway.
- What did the hacker actually do with DeepSeek?
- Palo Alto Networks' Unit 42 reported on July 30, 2026 that a Zhuhai, China-based actor known as 'knaithe' or 'KnYuan' wired the open-weight DeepSeek model into an open-source agent framework called Hermes Agent. After one instruction sent over Telegram, the agent scanned roughly 460 internet-facing systems, researched exploits, and attacked targets largely without further human input.
- Did this AI attacker actually breach real companies?
- Yes. Unit 42 confirmed the agent compromised three organizations running Citrix NetScaler through CVE-2026-3055, extracting memory data and attempting session hijacking against one target, a Malaysian government entity. It also gained command execution on 11 separate Marimo notebook instances through a second flaw, CVE-2026-39987.
- Why did the hacker use DeepSeek instead of Claude or ChatGPT for this?
- Unit 42 found the actor tried Western frontier models first and their safety controls limited use for autonomous attacks, so the actor switched to DeepSeek, which has minimal built-in safety restrictions, run through an agent framework with no client-side limits of its own. Researchers called it the first real-world evidence that AI providers' safety training has measurable defensive value, not just a policy claim.
- Is my construction company required to patch CVE-2026-3055?
- Not by law, unless you're a federal civilian agency — CISA's Binding Operational Directive 26-04 only mandates the 3-day patch window for those agencies. But the vulnerability has been on CISA's Known Exploited Vulnerabilities catalog since March 30, 2026, CISA recommends every organization use the same patch-priority framework, and this campaign shows unpatched instances were still being found and breached as late as May.
- What kind of system is Citrix NetScaler, and would a construction company even run one?
- It's a VPN gateway and application delivery appliance many mid-size and large firms use to let field offices, project managers, and subcontractors reach central servers, ERP systems, and accounting platforms remotely. It's common wherever IT is thin relative to the number of people needing off-site access — a description that fits a lot of construction back offices.