A hacker let AI run his cyberattacks solo. It barely worked — and that's the scary part

A hacker based in China spent days letting an AI model run cyberattacks on its own — picking targets, writing exploit attempts, firing them off — with no human in the loop. Unit 42 watched it happen. Out of seven serious vulnerabilities the AI tried, including a Windows VPN bug rated CVSS 9.8 that Microsoft just patched this month, the fully autonomous phase didn't compromise a single system. The scary part isn't that it worked. It's that the same operator, working manually against the same target list, got into three networks — and that gap between AI failure and human success is exactly what CVE-2026-33824's patch is meant to close.

The bug Microsoft actually needs you to patch

Strip away the AI framing for a second, because CVE-2026-33824 is a serious bug on its own merits. It's a double-free memory-corruption flaw in Windows' Internet Key Exchange (IKE) extension — the service that negotiates the cryptographic handshake for IPsec VPN connections. CVSS 9.8: no authentication needed, network-reachable, and a successful hit gets code execution on the box handling your VPN traffic. Microsoft shipped the fix in this month's Patch Tuesday alongside roughly 400 other flaws. If you're running an IPsec VPN endpoint on Windows and haven't applied that update, this is the one to move on first — not because an AI is chasing it, but because the underlying math (unauthenticated, network-facing, full compromise) would matter with or without the DeepSeek headline.

How 'Hermes Agent' actually worked

DeepSeek supplied the reasoning — deciding what to try and in what order. Hermes Agent, the operator's own orchestration layer, supplied the hands: terminal access, a Telegram-based command channel, and a custom skills system for chaining tasks together, with what Unit 42 describes as no built-in safety layer. The operator would issue instructions over Telegram, and from there Hermes Agent independently researched vulnerabilities across ten product families, ranked targets using FOFA's internet-scan deployment counts, pulled down public exploit code, and cycled through attempts — described in Unit 42's own words as happening "without human intervention" once set in motion.

The results: mostly failure, but not nothing

Of 460-plus systems the operation touched, the fully autonomous run landed exactly zero confirmed compromises. Every real win — three Citrix NetScaler instances with data pulled out, eleven Marimo Notebook instances with code execution — came from the same operator following up manually, not from Hermes Agent running unattended. The pattern across the failures is consistent: it wasn't the CVSS score that stopped the AI, it was ordinary configuration hygiene. Authentication that was actually enforced. A setting that hadn't been left on its insecure default. That's the boring stuff that also stops human attackers, and it stopped this one too.

Patch this one specifically

Set the AI story aside and CVE-2026-33824 is still the actionable item here: a perfect-9.8, unauthenticated, network-facing hole in the service handling your VPN handshakes, with confirmed exploitation attempts already logged. Reverse-shell callbacks against three endpoints haven't turned into a confirmed compromise yet — but "not yet" is doing a lot of work in that sentence.

This is part of a wider trend we've been watching all month: AI showing up on both sides of the security fight. OpenAI built a model that finds real Chrome zero-days and restricted who can use it; Unit 42's own AI tooling found 14,000 zero-days and got open-sourced anyway; and a separate AI-assisted exploit chain against SharePoint broke cover just weeks ago. One of the seven flaws in this exact campaign was a Citrix NetScaler bug we already covered. None of that makes the AI angle less newsworthy — it makes it more useful to read past the headline: patch the specific CVE, and treat the "autonomous" part as a capability still very much in progress, not a foregone conclusion.