This Hacker Is Letting DeepSeek AI Run Attacks on Its Own

Emily Davis · 2026-07-31

There's a new twist in the world of cybersecurity, and it's not the kind that makes you feel warm and fuzzy. A threat actor, who communicates in Chinese, has started using DeepSeek AI — the open-source model that's been making waves — to run attacks on exposed servers. The kicker? The AI is doing most of the work on its own, with very little human babysitting. That might sound like something out of a sci-fi movie, but it's happening right now. And for anyone who manages servers, or just cares about how the internet stays safe, it's worth paying attention to. ### What Exactly Is Happening? At the center of this is something called Hermes Agent, an open-source tool that acts like a digital assistant for cyber attacks. When paired with DeepSeek AI, it can scan for vulnerable servers, figure out how to break in, and then execute the attack — all without a human typing commands every step of the way. Think of it like this: Instead of a burglar manually checking every door in a neighborhood, you've got a smart robot that learns which doors are weak, picks the lock, and walks right in. Then it reports back to the burglar, who just sits back and watches. The attacks are targeting exposed servers — machines that are connected to the internet but aren't properly secured. These could be anything from a small business's database to a government system. The goal is often to steal data, install malware, or just cause chaos. ### Why DeepSeek AI Is a Game Changer DeepSeek isn't your average AI model. It's open-source, which means anyone can download it and tweak it to their liking. That's great for innovation, but it also means bad actors can customize it for their own purposes. And because it's designed to be efficient, it can run on less powerful hardware, making it accessible to a wider range of people — including those with malicious intent. What's really concerning is the level of autonomy. The AI can make decisions on its own, like which servers to target and how to adapt if its initial approach fails. That's a big step up from older attacks, where a human had to be involved in every step. - It scans for vulnerabilities automatically - It chooses the best attack method based on what it finds - It adjusts its strategy in real-time if something goes wrong - It minimizes the need for human oversight, making attacks faster and harder to trace For defenders, this is a nightmare scenario. Traditional security tools are built to stop known threats, but an AI that can learn and adapt on the fly is a moving target. ### What This Means for Your Servers If you're running any kind of server that's exposed to the internet, this should be a wake-up call. The days of "it won't happen to me" are long gone. Attackers are now using AI to find weak spots faster than ever, and they're targeting everyone — not just big corporations. Here's what you can do to protect yourself: - **Patch regularly:** Outdated software is the easiest way in. Keep everything up to date. - **Use firewalls:** Don't expose more ports than necessary. Close everything you don't use. - **Monitor logs:** Look for unusual activity, like repeated login attempts or unexpected data transfers. - **Enable two-factor authentication:** Even if a password gets stolen, a second layer can stop the attack. It's not about being paranoid. It's about being prepared. The threat landscape is changing, and the tools available to hackers are getting smarter by the day. ### The Bigger Picture This isn't just about one hacker or one AI model. It's about a shift in how cyber attacks are carried out. We're moving into an era where AI can be both a defender's best friend and an attacker's secret weapon. The same technology that helps businesses automate their security can be turned against them. There's also a geopolitical angle here. The threat actor is Chinese-speaking, which raises questions about state involvement or at least tolerance. But it's important not to jump to conclusions. Cyber crime doesn't respect borders, and attributing attacks to a specific country is always tricky. What's clear is that AI-powered attacks are here to stay. The only question is how we adapt. For now, staying informed and keeping your digital house in order is the best defense you've got. So, take a look at your servers. Ask yourself: Are they as locked down as they could be? Because the next attack might not just be knocking on the door — it might be picking the lock while you're asleep.