AINEWS
An AI agent ran the attack cycle before Palo Alto Networks' threat research team, Unit 42, stopped it. "Verify everything" cannot see what an authorized agent decides to do with what it can reach.
A Chinese-speaking threat actor used a DeepSeek-fine-tuned agent the researchers call Hermes to scan the internet for vulnerable servers, select targets, download exploits, and change course when each attempt failed. Palo Alto Networks' threat research team, Unit 42, stopped the operation before the agent compromised anything, according to the research published Sunday. The attack failed.
The agent's own logs exposed its operator's API keys, exploit code, target list, and attack history. That trail is evidence and a warning at the same time. A future agent that scrubs its own state before exfiltration would not leave it. The defender's current visibility depends on a property the attacker controls.
Forbes columnist Zak Doffman framed the incident as "authorized AI operating outside human supervision, not rogue AI." A human never typed the next command. The agent picked targets, retried on failure, and managed its own compute while it ran. Unit 42's researchers say the system "executed hundreds of hours of manual targeting analysis in mere minutes." At that pace, the question is no longer whether a defender catches a single attempt. The question is whether the defender's control plane is built for an opponent that does not sleep and does not give up.
For two decades, the default enterprise defense has been a version of "verify everything." Zero Trust, the framework most large security teams now run on, treats identity as the unit of access. A user, a service, or an agent presents credentials; the system checks them and grants the minimum privilege the task needs. It works because humans and conventional software are slow enough that re-checking identity at every step catches most abuse.
Agentic AI breaks the math, and not because the credentials were faked. The DeepSeek-powered agent authenticated normally. Authentication told defenders who was acting. It did not tell them what the agent was about to do with what it could reach. Identity is not authority. Two different operators can hold the same valid credential and intend completely different things with the next action, and the system cannot tell them apart.
The asymmetry inverts at agentic scale. A defender has to win every time. An attacker has to win once. The old assumption was that winning every time was feasible because humans and conventional malware are slow, expensive, and noisy. An autonomous agent compresses hours of human targeting into minutes, gives up on a path that does not work, and pivots to the next. The 99% of attacks the defender stops are not a victory. They are the cost of doing business for an attacker whose marginal attempt is near zero. Unit 42's characterization that the "margin of failure is narrow" lands differently once the loop runs at machine speed across thousands of targets.
Defenders need an authority layer above identity. Authority tokens have to be independently verifiable, time-limited, and revocable from outside the agent or the platform it runs on. Continuous checks must run against signals the agent cannot see or spoof: a human approval for high-risk actions, an out-of-band attestation that a given tool call matches the stated task, a kill switch that does not depend on the agent's cooperation. Today's controls, verify access and block known exploits, are structurally blind to a credentialed agent that has been told to do something the operator never intended. Catching that requires a layer that asks not who is acting but whether the action is within the authority the system was actually given.
The same actor had tried to use Claude and OpenAI models earlier and was blocked by those vendors' safety controls, according to Forbes columnist Zak Doffman. The DeepSeek-based attempt ran further because the operator used an open-weight model, fine-tuned for the task, on infrastructure the operator controlled. Open weights are not the problem. The problem is the same regardless of which model runs the agent: identity-based controls were not built to constrain an entity that decides for itself.
Unit 42's research is the first public, production-shaped walk-through of the cycle. The attack was stopped. The control plane that would have made the stop a structural outcome, not a near miss, does not exist yet.