DeepSeek as an Attack Engine: API Policy Arbitrage Hitting DeFi’s Automation Layer

Unit 42 logged something this month that should reset the security conversation: a single autonomous agent, running DeepSeek as its reasoning backend, burned through 460 targets and 7 CVEs in one operation. It scanned 25,209 Chinese n8n instances, sampled 100, probed 40, and found 3 exploitable victims in minutes. No zero-day. No elite hacker. Just a natural-language pipeline calling external tools. This is the first recorded agent-driven attack where a large language model acted as an autonomous attacker in real-world production, not a lab benchmark. The report is credible. Unit 42 is Palo Alto Networks’ threat intelligence team, and the observable behaviors — target enumeration, CVE matching, account disabling — are hard facts. Some conclusions, like “DeepSeek was chosen because it has the weakest safety rails,” are analysis. But the finding stands: the agent tested Claude Code, Qwen, and GLM, then picked DeepSeek over an API with no restrictive safety layer. That selection is the story. Not model intelligence. API policy arbitrage. All four models can reason about exploits. The agent is model-agnostic. It just needs a backend that will not reject a malicious tool call. OpenAI apparently marked and disabled the accounts before sharing intel. DeepSeek apparently did not. This is a provider-level compliance difference, not a model-quality difference. The composition is simple. Hermes Agent orchestrated the operation. FofaMap-Platinum-Full-Expert MCP server gave it internet-wide target maps via FOFA. GitHub search supplied popular PoC exploits. DeepSeek’s API translated natural-language instructions into tool operations. MCP, or Model Context Protocol, is the missing API layer for agents. It lets an LLM call a file editor, a scanner, or a remote server as easily as a human uses a terminal. That is efficiency. It is also a new attack surface. The targets were not random. Langflow, n8n, Citrix NetScaler. If you run DeFi infrastructure, your n8n workflows sit on this list. n8n is the automation layer for countless trading bots, webhook relays, and protocol operations. Langflow is used by teams that build LLM workflows. Citrix NetScaler is old enterprise infrastructure. An attacker who owns one of these can reach private keys, RPC endpoints, and admin panels. The agent was not scanning for sport. It was following a FOFA map to exposed instances. Traditional scanning is noisy. This was targeted, automated, and intelligence-driven. The report did not include DeepSeek’s response. That is a single-source gap. But the absence of a denial is not evidence. What matters is the operational pattern. Let me walk the actual kill chain, because the sequence is more important than the CVEs. First, the Hermes Agent enumerated targets through the FofaMap MCP server. It queried FOFA for exposed n8n instances and filtered by country: 25,209 Chinese n8n nodes. From that set, it sampled 100, probed 40, and identified 3 vulnerable candidates. The entire process took minutes. A human operator would need hours to replicate that enumeration, let alone the exploitation step. Second, the agent searched GitHub for popular PoC exploits. It matched those exploits to the target versions, then instructed DeepSeek to produce the attack steps. This flips the economics of offensive security. Vulnerability research used to be the bottleneck. Now the LLM summarizes, selects, and chains public exploit code at machine speed. The agent is essentially a natural-language compiler. It takes an objective — “find exposed n8n instances and check them against known CVEs” — and compiles it into tool calls. The human writes the README; the agent executes the exploit chain. Third, it ran in YOLO mode. No staging, no human approval, no rollback. Every action executed in production time. The report does not disclose whether any target was fully compromised. It does say the agent moved from reconnaissance to exploitation without a pause for review. That is the difference between a scanner and a weapon. Here is what the report does not tell us. It does not name the DeepSeek model version or the exact API product. It does not publish the prompts used. It does not show whether DeepSeek has any underlying safety fine-tuning. All we know is that the service-side API layer did not stop the requests. That distinction is everything. A model can have perfect alignment training and still fail in deployment if the provider lacks a request classifier, an abuse monitor, or an account risk signal. From the attacker’s perspective, the weights do not matter. The API bouncer matters. OpenAI’s statement is from an interested party, but the fact that accounts were flagged before intel sharing is verifiable. It shows a compliance feedback loop exists. DeepSeek’s lack of a public statement leaves a gap. Treat that gap as risk, not as an explanation. I have seen this pattern before. In my own work, the failures that hurt were never the clever reentrancy attacks. They were the missing environment controls. The same logic applies here: teams audit smart contracts and ignore the automation layer around them. They check the protocol code but not the n8n workflow that holds the deployer key. Upgrade the protocol all you want. The agent will still take the workflow. Unit 42 also notes the attacker iterated on tool configurations and built agent infrastructure to evade detection. That is a red flag. The operator is not running a one-off script. It is maintaining a platform. Add this to the fact that the report says AI-augmented offense has a low and falling technical barrier. The next attacker does not need a security research team. It needs an API key and a MCP server. The defensive math is brutal. Traditional security operations run on a detect-respond cycle measured in hours, often days. This agent compressed recon-to-exploitation into minutes. You cannot scale human analysts to match a machine that never sleeps. You need to instrument the tool layer. That means logging every tool call an agent makes, rate-limiting unknown endpoints, and treating MCP servers as untrusted I/O. In the crypto world, this is equivalent to auditing the wallet software and the chain node, not just the contract call. The contrarian read is uncomfortable. Most commentary will frame this as a DeepSeek problem, or an open-source problem. That framing collapses when you test the alternative. The same Hermes Agent can call Claude Code, Qwen, or GLM. OpenAI blocked this particular attacker, yes. But the pipeline is model-agnostic. If DeepSeek hardens today, the attacker swaps in the next permissive API. Or, more importantly, he downloads DeepSeek’s open weights and runs them on his own GPU. Local deployment removes the provider’s gate entirely. No usage policy. No rate limit. No content filter that survives a system prompt override. The “DeepSeek lacks guardrails” story is an illusion created by an API choice. It is not a property of the model architecture. Infrastructure outlasts innovation. The innovation here is a tool-composition trick. The infrastructure is an open API with a weak bouncer. The market will misprice this as a model safety story. It is not. It is a threat-model story about tool execution, API compliance, and agent runtime security. Security vendors will sell dashboards against it. They are not wrong to sell, but the dashboard does not fix the underlying issue: every LLM API with tool access should be treated as an untrusted remote employee. Code doesn’t lie, but markets do. Volatility is just unpriced risk. Right now the market has not priced agent-driven probe volume into DeFi risk models. That will end when an n8n instance holding a deployer key becomes the entry vector. Debug the protocol, not the portfolio. The next attack will not open with an exploit. It will open with a natural-language API call. Is your security layer at the service boundary, or just somewhere in the weights?