Jailbroken DeepSeek V4 helped a hacker steal more than 5,200 Indian university records in an AI cyberattack

A Unit 42 investigation found that a hacker using the alias BUGSTER used a jailbroken DeepSeek V4 to attack multiple universities in India, steal more than 5,200 student and faculty records, and carry out various AI-assisted cybercriminal activities. The attacker configured DeepSeek V4 as the inference engine for the Hermes Agent framework while also using Cursor IDE, and the security controls of both systems were disabled or bypassed. The researchers said the individual used basic tools and relied on AI-generated scripts and reconnaissance reports, indicating that they did not possess the skills such activity required before AI tools became widespread. Their activities spanned credential theft, data exfiltration, VoIP fraud, Wi-Fi password cracking and cryptocurrency reconnaissance; in one incident, the attacker obtained an administrator account protected by a weak password and exported a MongoDB database containing personally identifiable information. The researchers also found that other actors unrelated to this attacker are adopting the combination of Hermes and DeepSeek, describing it as low-cost with little security resistance.