Dark Perimeter: "The Machine Picked the Target"

Six hundred and forty seven thousand internet-exposed n8n instances, counted by software that then decided, on its own, which ones were worth attacking. We know that because the attacker's agent started a file server in its home directory and served its operator's entire environment to the internet, where Palo Alto's Unit 42 found it.Cole Drayden, Dr. Elliott Vance and Marcus Hale work through three stories from one week and argue they are one story:The autonomous campaign. Unit 42's report on an actor operating as knaithe / KnYuan, running DeepSeek inside the Hermes Agent framework with a terminal, Telegram C2, and custom skills. What ran autonomously (target enumeration via FOFA, vulnerability triage, exploit retrieval, exploitation attempts, pivot decisions) versus what a human did by hand (every single confirmed compromise). The autonomous attempts against Langflow and n8n failed. The manual work exfiltrated data from three Citrix NetScaler targets and executed commands on eleven Marimo instances. Why the failure is the least interesting part.The volume. August Patch Tuesday, where the CVE count is 415 or 421 depending on whose tally you use, and we say why rather than picking one. CVE-2026-68820, a use-after-free in afd.sys under active exploitation, added to CISA KEV the following day, and the fourth afd.sys zero-day since 2022.The edge. Cisco CVE-2026-20349 in Secure Firewall ASA and FTD, actively exploited, no workaround. Progress Kemp LoadMaster CVE-2026-8037, CVSS 9.6, 792 exploitation attempts over 41 days, and a three-day federal remediation deadline under BOD 26-04.Plus four things a security director can start this week, and why obscurity stopped being an accidental control the moment attacker attention stopped being scarce.Confirmed findings, vendor assessments, and researcher inference are kept distinct throughout.Dark Perimeter: True Cybersecurity Stories.Support the show