{
 "id": "AIR-2026-0363",
 "slug": "threat-actor-uses-deepseek-powered-hermes-agent-for-exploita",
 "title": "Threat Actor Uses DeepSeek-Powered Hermes Agent for Exploitation",
 "summary": "A threat actor configured Hermes Agent with DeepSeek as its reasoning engine to facilitate terminal access and exploit Langflow and n8n. The agent utilized integrated tools and custom red-team skills during the session.",
 "type": "ai_enabled_attack",
 "categories": [
  "ai_assisted_intrusion"
 ],
 "severity": 3,
 "targets": [
  "open_weight_model",
  "framework_or_tooling"
 ],
 "products": [
  "DeepSeek",
  "Hermes Agent",
  "Langflow",
  "n8n"
 ],
 "incident_date": "2026-05-07",
 "incident_date_precision": "day",
 "first_reported": "2026-08-30",
 "sources": [
  {
   "url": "https://atlas.mitre.org/studies/AML.CS0070",
   "publisher": "MITRE ATLAS",
   "title": "Threat Actor Uses a DeepSeek-Powered Hermes Agent in Langflow and n8n Exploitation Attempts",
   "published_at": "2026-08-30"
  },
  {
   "url": "https://unit42.paloaltonetworks.com/autonomous-ai-cyber-attack-campaign",
   "publisher": "Unit 42",
   "title": "Chinese-Speaking Threat Actor Harnesses AI Models for Autonomous Cyberattacks",
   "published_at": "2026-08-30"
  }
 ],
 "source_count": 2,
 "confidence": 0.95,
 "status": "published",
 "origin": "seed_atlas",
 "tags": [
  "deepseek",
  "hermes-agent",
  "langflow",
  "n8n"
 ],
 "created_at": "2026-10-18T06:55:08.239Z",
 "updated_at": "2026-10-18T06:55:08.239Z"
}