A DeepSeek AI agent attacked the network of a cybersecurity firm as part of a proxyjacking campaign, spurring the firm to set a trap and take control of the agent.
The attack, observed and then intercepted by Tel Aviv-based AI cybersecurity firm Jesta Security, marks the the latest example of AI agents attacking third-party networks in recent weeks, according to a report published today. But in contrast to the OpenAI model attack on Hugging Face during a benchmark test — the inadvertent result of the large language model (LLM) trying to find the best way to solve a problem — this attack was intentional, Aviv Halfon, co-founder and CEO at Jesta, tells Dark Reading.
“A human threat actor with malicious intent deliberately weaponized an AI model to run an agentic attack campaign end to end,” he says. However, the goal wasn’t to steal, encrypt of modify anything on the system, but to build infrastructure for more attacks. “The attacker was using our compromised environment to stage its next operations,” Halfon says.
Jesta also was able to identify the attacker as an AI model, and track its activities to understand the origin and nature of the attack. “Unlike the OpenAI incident, the discovery and knowledge about this campaign came from the defender’s side,” Halfon says.
Moreover, this subsequent investigation revealed “strong indicators” that a Chinese threat actor is behind the weaponization of the model, including activity tied to a Beijing time zone as well as the inclusion of Chinese characters in payloads, he says. “These factors point to a Chinese origin,” Halfon tells Dark Reading.
The Five-Day Agent Attack
The attack started on “a quiet Thursday,” July 2, when Jesta researchers noticed some unusual activity that began scanning their environment in a way that seemed human “but at super-human speed,” according to the post. Jesta is currently in stealth mode and aims to build a defense layer against autonomous AI attacks.
The researchers verified that the activity was not coming from an internal source, and suspected it was an AI model. They eventually set up a trap by seeding the environment “with a few things a language model cannot ignore, nothing a human would look at twice,” and waited to see what it would do in response, according to the report.
Over the course of five days, the model conducted reconnaissance and attempted to profile the target system through hundreds of short-lived SSH sessions, according to Jesta. The activity was characterized by a distinctive pattern: the agent connected, executed a single command, disconnected, and returned after brief pauses to “think.” Over the five-day period, researchers recorded 871 sessions, most lasting less than two seconds, they said.
Jesta researchers studied the activity and determined that the agent’s apparent objective was proxyjacking by compromising weakly secured servers and deploying MicroSocks SOCKS5 proxies to create a distributed network of relay infrastructure. The researchers also discovered a target list containing 1,283 hosts, along with credentials associated with those systems, that could then be used as exit nodes for subsequent scanning, intrusions, or other malicious activity.
All Signs Point to Autonomous AI
The attack provided several clues as evidence that it was “completely autonomous,” Halfon tells Dark Reading. For one, the scale of the campaign — which also targeted about 1,000 other victims beyond Jesta in the same way — was not something a human could do simultaneously, he says.
Secondly, “the behavior itself was fully agentic,” complete with hallucinations, structuring of output only in a way for a model to read, and response times even of critical decisions that a human could not achieve, Halfon says.
“The final straw was that we used our capability to force the model to extract and dump its exact identity, and it did it in a split second — that excludes a human in the loop,” he adds. That identity was of a Deepseek version 4 “Flash free” model being driven by an LLM.
Jesta contacted and confirmed the attacks with some of the victims it discovered in its investigation — which were mostly small-to-medium-sized businesses (SMBs) hosting websites and applications — as well as their respective cloud providers, but they wished to remain anonymous, Halfon tells Dark Reading.
Engagement Is Best Defense Against AI
Indeed, the evidence is mounting that autonomous AI attacks may soon become the rule rather than the exception, especially by less-skilled attackers, and defenders need to prepare, Halfon says. “The campaign we discovered, among others, indicates that the mass and intensity of future ones will only increase and grow,” he says.
Jesta’s own response to the attack can help inform organizations about what to do and what not to do when an AI model leads an attack. In the latter category, a response that only blocks the attacker just teaches it to try a different direction, and faster, and doesn’t give defenders any information about the attack or how to prepare for the next one, Halfon says.
On the contrary, “by engaging the attacker instead, you learn what it’s really doing: the zero-day it may be using, its attribution, its objective and tools, and more,” he says. “Engagement lets you stop the attack faster, and makes this attack, and the next AI-driven ones, far more expensive and far harder to run,” Halfon says.
SMBs that may not have the resources to do this can still strengthen their security posture by ensuring there are no default credentials or exposed ports in their infrastructure, at least not without reason, he adds.
“Beyond that, against AI attackers specifically, we’d suggest simple deception — honeytokens and tripwires,” Halfon says. “Because an AI agent tries every path it can and struggles to tell what’s real from what isn’t, that interaction becomes surprisingly easy to detect. For an SMB, that’s a cheap, high-signal early warning.”
