Fetching from the wire…
01
02
03
04
05
06
07
08
Security2026-08-02 · source-backed
Unit 42 documented an operator in Zhuhai driving the Hermes Agent framework over Telegram with DeepSeek as the reasoning engine, selecting targets and changing tactics after failures. Confirmed impact was narrow: three Citrix NetScaler memory-exfiltration compromises (CVE-2026-3055) and 11 Marimo command-execution endpoints (CVE-2026-39987) across seven CVEs. The detail worth holding: the actor tested Claude Code and Codex too, and OpenAI's safety systems flagged and disabled a linked account. The campaign was only discovered because Hermes accidentally served the attacker's home directory over HTTP, exposing API keys, exploit scripts, target lists, and the AI attack logs themselves.
Each link below shares sources, entities, or timing with this story.
Claude Code partners with Telegram / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Claude Code partners with Telegram); both cover Claude Code, CVE, HTTP, OpenAI; overlapping topics (agent, attack).
Claude Code partners with Telegram / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code partners with Telegram); both cover Claude Code, Codex, Hermes, Hermes Agent; overlapping topics (agent, herm, target).
Claude Code partners with Telegram / Shared entities / Earlier coverage
Linked by a graph relationship (Claude Code partners with Telegram); both cover Chinese, Claude Code, Codex, DeepSeek; earlier Chinese coverage from 2026-07-08.
Claude Code partners with Telegram / Shared entities / Shared topic / Earlier coverage / Tension
Linked by a graph relationship (Claude Code partners with Telegram); both cover Claude Code, Codex, OpenAI; overlapping topics (agent, attack).
OpenAI uses Claude Code / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (OpenAI uses Claude Code); both cover DeepSeek, HTTP, OpenAI; overlapping topics (account, campaign, deepseek).
Claude Code partners with Telegram / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Claude Code partners with Telegram); both cover Claude Code, CVE, CVEs; overlapping topics (agent, attack, framework).
OpenClaw supports Telegram / Shared entities / Earlier coverage
Linked by a graph relationship (OpenClaw supports Telegram); both cover Claude Code, Codex, Hermes Agent, OpenAI; earlier Claude Code coverage from 2026-07-30.
Claude Code partners with Telegram / Shared entities / Earlier coverage
Linked by a graph relationship (Claude Code partners with Telegram); both cover Claude Code, Codex, Hermes, OpenAI; earlier Claude Code coverage from 2026-07-21.