AI agent incident

A China-linked actor drove DeepSeek through Telegram to attack internet-facing systems

Reported · 3 sources

  • autonomous-attack

What happened

Unit 42 reported that a China-linked actor used DeepSeek through the Hermes agent to find and exploit internet-facing systems after a single Telegram command, and researchers separately intercepted an attempt to compromise more than 1,200 hosts for proxyjacking. Other reporting noted the operator fell back to manual methods when the automated approach failed.

Why it matters

It is among the first observed uses of a general-purpose model as the driver of a live attack chain rather than as a writing aid, and the failure rate is as informative as the successes for anyone sizing the threat.

Sources

  1. The Hacker News Chinese Hacker Commands DeepSeek via Telegram to Launch Autonomous Attacks
  2. Cybersecurity Dive China-based hacker employs DeepSeek in autonomous threat campaign
  3. Dark Reading Chinese Actor Weaponizes Deepseek AI Agent to Attack Security Firm

New incidents by email

Get incidents like this one in your inbox

New AI agent incidents are covered in the briefing, with what to check on the agents you already run. At least once a week, free.

You confirm by email. Unsubscribe in one click.

Cite or correct this record

“A China-linked actor drove DeepSeek through Telegram to attack internet-facing systems.” The Permission Layer AI Agent Incident Database, https://thepermissionlayer.com/incidents/deepseek-telegram-autonomous-campaign/. Database updated October 22, 2026.

Every record traces to the dated sources above. If something here is wrong or missing, email [email protected] and it gets fixed. See this record in the full list.

The Permission Layer

Get the briefing by email

At least one email a week on AI agent identity, permissions, security and spend, written for the people who approve agent access. Five-minute read, free.

You confirm by email. Unsubscribe in one click.