SURIQ
An autonomous attack operator did in minutes what a human red-teamer spends days on: fingerprint thousands of exposed services, rank them by how easily each could be exploited, and start firing. What it could not do was break into anything that asked for a password. That gap is the whole story. On July 31 Palo Alto Networks' Unit 42 published a teardown of a China-based operator, tracked under the aliases knaithe and KnYuan, who wired the DeepSeek model into an open-source agent and pointed it at the open internet.
The setup reads like a diagram from a conference talk. The operator drove the agent over Telegram, gave it access to the FOFA asset search engine, and let it run in an autonomous mode that needed no per-step approval. From one initial instruction it enumerated targets, checked software versions, downloaded public exploits, abandoned dead ends, and pivoted to the next candidate on its own. Unit 42 recovered a session from May 2026 and counted attempts against more than 460 targets across both autonomous and manual workflows. The reconnaissance that would take an analyst days collapsed into a few minutes of machine time.
Where the agent stalled
Read past the headline and the autonomous exploitation record is thin. The agent's first target set was Langflow, an AI workflow builder with an unauthenticated code-execution flaw, CVE-2026-33017. It found 84 exposed instances through FOFA and failed to pop any of them, because the bug needs either auto_login enabled or a known public flow ID, and the internet-facing hosts did not hand those over. It moved to n8n, the workflow automation platform, chaining CVE-2026-21858 and CVE-2025-68613. FOFA returned 647,017 n8n instances worldwide and 25,209 in China; the agent sampled around 100 and probed roughly 40. It located three vulnerable versions and got nowhere, because every viable path required authentication it did not have.
That is the pattern the recap coverage skips. The model was fluent at finding and triaging targets and stalled the moment a login stood in the way. It shifted the economics of targeting, not of exploitation. The exploits themselves were public, already-patched CVEs, and the ones that mattered had a control the reconnaissance could not reason its way around: a credential.
Where it got in
The confirmed compromises came from a narrower, blunter set of bugs against services that were exposed and, in most cases, unauthenticated. Unit 42 verified data exfiltration from three organizations through Citrix NetScaler CVE-2026-3055, and command execution on 11 Marimo notebook instances through CVE-2026-39987. The operator also threw reverse-shell attempts at nine Apache Tomcat servers via CVE-2026-34486 and sent callbacks at three IKE VPN endpoints via CVE-2026-33824.
| Service | CVE | Exposed set | Outcome |
|---|---|---|---|
| Langflow | CVE-2026-33017 | 84 found | Failed, config preconditions unmet |
| n8n | CVE-2026-21858, CVE-2025-68613 | 647,017 global; 25,209 in China | Failed, all paths required authentication |
| Marimo | CVE-2026-39987 | 11 instances | Command execution |
| Citrix NetScaler | CVE-2026-3055 | 3 organizations | Data exfiltration |
| Apache Tomcat | CVE-2026-34486 | 9 servers | Reverse-shell attempts |
| IKE VPN | CVE-2026-33824 | 3 endpoints | Reverse-shell callbacks |
Look at the victim column and a class comes into focus. Langflow, n8n, Marimo notebooks: these are developer and workflow tools that a team stands up to move fast, exposes to the internet for convenience, and forgets to put behind a login. They are shadow-IT-class exposures, not core infrastructure, and they are exactly what an automated sweep surfaces first. The one heavyweight in the list, NetScaler, is a customer-managed edge appliance where a missed patch on an internet-facing box is the oldest story in the business. We wrote about that the last time NetScaler shipped a batch of fixes, and the lesson has not moved.
What actually changed for defenders
The temptation is to file this next to the research showing AI models breaking into companies in controlled tests and conclude the machines are writing the exploits now. They are not, at least not here. Every break-in used a known CVE with a patch already available. What the agent added was speed at the one step defenders have quietly relied on being slow: finding you.
For years the practical grace period on an exposed service was measured in discovery lead time. You could stand up an internet-facing dashboard, know it was a risk, and bet that a scanner would not single it out and chain the right exploit before your next patch cycle. That bet is off. An operator can now enumerate a service class, sample it, rank it by exploitability, and start probing in the time it takes to read this paragraph. The metric that changed is not the attacker's skill. It is how long you have between exposure and first contact, and it just went to roughly zero. The same collapse showed up in the first AI-run ransomware case against a Langflow server: same soft target, same speed.
The signal is breadth and speed
If autonomous exploitation is still weak, autonomous reconnaissance is the part to detect. The behavioral tell here is not a clever payload, it is shape: one source touching many unrelated services in a compressed window, cycling through exploit families for Langflow, n8n, Tomcat, NetScaler and IKE VPN in minutes rather than working a single target patiently. That breadth-and-velocity pattern is anomalous on its own, and it is the kind of cross-service correlation a detection layer that watches the whole estate can flag before a slow human analyst would.
There is a second, almost comic lesson. The operation was exposed because the agent, following a Telegram command, started a plain file server from the operator's own working directory instead of an isolated staging area, publishing its own configs, keys, exploit scripts, target lists and session logs to anyone who looked. Automation scaled the attacker's reach. It did not scale the attacker's operational discipline. The machine ran fast and left the door open behind it.
Take your exposed dashboards off the internet first
The remediation order follows the exposure, not the CVE severity. First, treat every internet-facing management, notebook and workflow UI as already discovered, because it now is: put Langflow, n8n and Marimo behind authentication or a VPN, or take them off the public internet entirely. Second, patch the edge appliances that actually got hit, updating customer-managed NetScaler ADC and Gateway to a fixed build and confirming the SAML identity-provider configuration CVE-2026-3055 abuses. Third, run continuous exposure and vulnerability checks against your own external footprint on the assumption that an automated operator is enumerating it on the same cadence you are. The autonomous agent is not the thing that beats you. The forgotten dashboard it finds in ninety seconds is.