Microsoft IKE CVE-2026-33824: When an Autonomous AI Drives the Exploitation Campaign

> TL;DR: CVE-2026-33824 (CVSS 9.8) is a double-free vulnerability in Microsoft's Internet Key Exchange (IKE) Service Extensions, enabling unauthenticated remote code execution. What makes this case particularly notable isn't the flaw itself, but how it was exploited: a Chinese threat actor let the DeepSeek AI model, via the Hermes Agent framework, autonomously identify and target more than 460 organizations.

The technical flaw

A double-free (double memory deallocation) vulnerability in Microsoft's IKE Service Extensions — a core component of IPsec-based VPNs — allows an unauthenticated remote attacker to execute arbitrary code. CISA added it to its Known Exploited Vulnerabilities catalog on August 18, 2026.

What sets this campaign apart: offensive AI autonomy

According to analysis by Palo Alto Networks Unit 42, the actor — based in Zhuhai, China, and operating under the aliases knaithe and KnYuan — used DeepSeek as an autonomous offensive operator. The observed sequence is telling:

In total, the actor attempted to compromise more than 460 targets combining autonomous and manual techniques.

Why this is a warning for every vendor, not just the direct targets

This campaign illustrates a shift in the nature of the threat that we cover regularly: AI agents are no longer just assisting a human operator — they're making autonomous decisions about reconnaissance, target selection, and adapting after a failure. The gap between a failed exploitation attempt and the pivot to another target is now measured in minutes, not days. For any internet-exposed organization, that means your entire attack surface (not just the most obvious systems) can be probed near-instantly and systematically.

What to do

What CleanIssue checks for

Our audits include a review of the exposure of your network and automation components, accounting for the fact that the gap between disclosure and exploitation is shrinking, partly driven by AI-assisted attack tooling.

Key takeaways