Jesta Security published an account today of an autonomous AI agent that spent five days inside its honeypot lab, running 871 short sessions and installing SOCKS5 proxies on the hosts it reached. The claim that DeepSeek drove it comes from one piece of evidence: the flag --model=deepseek-v4-flash-free appearing in the attacker’s own scripts. That is a string the intruder’s tooling wrote, and a default config value looks identical to a confession. The behaviour Jesta describes is worth taking seriously; the model attribution is unsettled, and Palo Alto’s Unit 42 reported a separate DeepSeek-driven campaign four days ago, so “first” is the wrong frame either way.
The whole “DeepSeek did it” story turns on a command-line flag. Tel Aviv startup Jesta Security says the intruder in its honeypot lab left --model=deepseek-v4-flash-free sitting in its own scripts and commands, and Dark Reading’s write-up calls this the first time the model behind a live intrusion has been named from inside the intrusion. Named by the attacker’s own config file, which is a different thing.
What Jesta logged in five days
First contact came on 2 July 2026, a 90-second reconnaissance session, 32 days ago. Over the following five days the lab recorded 871 sessions, each one a single short command with a deliberate pause before the next. The campaign closed on 6 July with a nine-hour run from 09:00 to 18:00, office hours in UTC+8.
The objective was proxyjacking. The agent installed MicroSocks SOCKS5 proxies on hosts it reached, building anonymized relay infrastructure. Jesta recovered a target list of 1,283 hosts and estimates roughly 1,000 other victims took the same treatment.
That behavioural profile is the strong part of the report. Human operators do not pace 871 commands evenly across five days, and the session shape (one command, wait, one command) reads like a loop rather than a person at a terminal. Jesta’s framing of the defence deserves more attention than it will get: the lab engaged the intruder to pull intelligence out of it, instead of closing the door.
The model string proves less than it looks
Nothing about --model=deepseek-v4-flash-free proves DeepSeek generated those commands. The flag is content the attacker’s tooling put in the attacker’s own scripts. It could be a default that shipped with whatever agent framework the operator cloned, a leftover from copied code, or plainly wrong.
Verifying it would mean corroboration from the API side, and Jesta’s account claims none. No statement from DeepSeek appears in any of the reporting. Neither could I confirm that Jesta has released raw logs or the recovered scripts for anyone else to check; the blog post works from excerpts and summaries.
The actor attribution is thinner still. Jesta points to Beijing-hours activity and Chinese characters in payloads, and attaches no handle, group, or individual to the intrusion. Timezone plus character set is where attribution starts, not where it ends.
Worth weighing alongside all of this: Jesta is a stealth-mode company selling AI-native defence against precisely the attack it says it discovered. The logs can be exactly as described and the world-first framing still be a pitch.
Unit 42 found the same pattern, with a named actor
Four days ago Palo Alto Networks’ Unit 42 published its own autonomous-attack report: a Chinese-speaking actor using the handles “knaithe” and “KnYuan”, driving DeepSeek through the open-source Hermes Agent framework to scan and exploit unrelated targets. The recovered session dates back to May 2026. Two DeepSeek-powered autonomous campaigns surfaced in one week, from unrelated actors, which describes a pattern rather than a landmark.
Unit 42’s numbers also deflate the supercharged-hacking reading. The campaign made more than 460 exploitation attempts and confirmed three compromises, all against known and already-patched vulnerabilities, per The Hacker News. Autonomy bought volume and cheap labour, applied to capability the operator already had.
Reported scale figures for that campaign vary across secondary coverage, with one source citing roughly 25,209 vulnerable n8n instances in China and another 647,000-plus exposed globally. Treat both as unconfirmed.
What defenders should take from this
The interesting claim in both reports is economic. A free-tier model plus an off-the-shelf agent framework gives one operator the throughput of a small team, aimed at commodity work like proxy installation and known-CVE scanning. Zak Doffman’s Forbes piece frames the risk as agentic attacks that “will scale faster than our ability to control it”, which overstates a threat currently converting 460 attempts into three boxes.
For defenders the model name changes nothing. Patch the known CVEs, watch for MicroSocks and other SOCKS5 binaries appearing on hosts you did not put them on, and alert on machine-cadence session patterns. An agent that pauses politely between 871 commands is still a signature you can match, whichever model sits behind it.
When the next report names a model, ask what the naming rests on. If the answer is a string in the attacker’s config, that is a lead worth chasing. Knowing is a higher bar.
Sources: DarkReasoning (Jesta Security) • Autonomous AI Cyber Attack Campaign (Unit 42)
Coverage: Dark Reading • The Hacker News • BleepingComputer • Forbes
Related on this blog: Liang Wenfeng Says CUDA’s Moat Falls in a Year. The Wall He Can’t Climb Takes Three. • The Swarm Is the Branding. One Agent in a Loop Did the Work. • JADEPUFFER’s 19-Day Upgrade: Ransomware Built to Destroy AI Models