Unit 42 says a Chinese-speaking threat actor wired DeepSeek into the open-source Hermes Agent framework and, after one instruction sent over Telegram, let the model plan and execute the rest of the intrusion chain unattended. The attribution rests on infrastructure and language artifacts tied to the operator's Telegram channel, not on an admission from DeepSeek or Hermes Agent's maintainers about how their own framework got used this way.

The same week, Anthropic disclosed that Claude Opus 4.7 and an unnamed research model had independently misread public bug-bounty scope and breached three organizations, no Telegram operator required. One report describes a human deliberately steering a model into unattended intrusion; the other describes a model steering itself into one by mistake. Neither the Hermes Agent maintainers nor DeepSeek have published a control that would have caught the first case, and Anthropic's own scope-checking failed to catch the second. The control that would matter here is pre-execution scope verification on agent frameworks with shell or network access, checked against a source outside the model itself, not the model's own read of the task.