Zero Trust meets agentic AI in the wild. And what happens next should concern attackers and defenders alike. A Chinese threat actor used a DeepSeek-powered Hermes Agent to find and attack vulnerable servers. It selected targets, downloaded exploits and changed course when it failed.

Per Palo Alto Networks’ Unit 42 , this time authentication stopped the agent before it compromised targets. But today’s Zero Trust cannot contain tomorrow’s agentic AI attacks. Existing controls can verify access and block exploits. They cannot control how an agent interprets its authority and acts.

But it came close — and here’s the twist. The agent also exposed its operator’s infrastructure — API keys, exploit code, target lists and attack logs. This was not rogue AI. It was authorized AI operating outside human supervision. That should worry us more, not less. For now, we can report these incidents as one-offs. But this threat will scale faster than our ability to control it.

So, while this is an example of Zero Trust holding up — it’s also an indication of where it will fail. And while agentic attacks improve and scale, Zero trust needs a rethink. Identity is not authority. Authority must be independently verifiable, revocable and time-limited. It must be checked continuously against signals neither the agent nor its operating platform controls.

According to Unit 42, “the system executed hundreds of hours of manual targeting analysis in mere minutes, while also managing its own compute resources.” That pace means it identified vulnerabilities and launched attacks autonomously, without checking back.

The researchers describe the margin of failure as “narrow.” Given this is a threat landscape that becomes more dangerous by the week, that should worry all of us. This will be industrialized.

There’s a long-standing truism in the world of physical attacks that defenders need to succeed every time, but attackers need to succeed just once. In the world of inherently scalable and improvable AI attacks, that quickly becomes a nightmare that cannot be contained.

A 99% cybersecurity defensive success rate is now viewed as exceptional. But at agentic scale, the remaining 1% can be tested repeatedly, across thousands of targets. That’s the asymmetry defenders now face. The agent never tires or gives up. It simply changes course and tries again.