DeepSeek-Powered Rogue AI Agents Are Hitting Servers—And US Lawmakers Demand Answers From DoorDash

A Chinese-speaking threat actor is reportedly using the DeepSeek AI model alongside the open-source Hermes Agent to run autonomous cyberattacks against exposed servers, with limited human involvement. The reporting describes an operational shift: instead of purely scripted intrusion steps, the attacker is leveraging an AI agent framework to probe, decide, and act more dynamically. The same day, separate coverage points to “rogue AI-agent security breaches,” underscoring that the broader ecosystem of AI agents is being tested in the wild, not just in labs. In parallel, US lawmakers have escalated the policy dimension by requesting information from DoorDash about its use of Chinese AI models, framing the issue as a supply-chain and data-governance risk. Taken together, the cluster suggests both a technical threat trend and a political response cycle converging on AI-enabled operations. Geopolitically, the story sits at the intersection of cyber offense, AI supply chains, and strategic mistrust between Washington and Beijing. If AI agents can reduce the need for skilled operators, the cost of launching disruptive intrusions falls, potentially increasing the frequency and scale of cross-border cyber incidents. That dynamic benefits attackers and complicates attribution, while it pressures defenders and regulators who must update controls faster than adversaries iterate. The US congressional inquiry into DoorDash signals that the policy arena is moving from abstract “AI risk” to concrete procurement and vendor transparency, especially where Chinese models are involved. Meanwhile, the reported use of DeepSeek in offensive tooling raises the stakes for export controls, model governance, and the credibility of voluntary compliance. Market and economic implications are likely to concentrate in cybersecurity, cloud infrastructure, and consumer-facing platforms that rely on AI for operations. If autonomous agent intrusions become more common, demand for endpoint detection, identity security, and managed incident response could rise, supporting vendors and insurers tied to cyber risk. For DoorDash specifically, the inquiry can translate into compliance costs, potential reputational damage, and heightened scrutiny of AI vendors, which may affect sentiment around platform risk management. On the macro side, persistent cyber uncertainty tends to lift risk premia for critical digital infrastructure and can widen spreads for firms with higher data exposure. While no direct commodity or FX move is specified in the articles, the likely near-term market signal is a higher probability of cyber-related volatility in tech-adjacent equities and insurance pricing. What to watch next is whether regulators broaden the DoorDash inquiry into a wider set of consumer platforms and whether they request model-level documentation, data-flow diagrams, and third-party audit results. In parallel, defenders should monitor for indicators that AI-agent tooling is being used in real intrusions—such as unusual autonomous scanning patterns, rapid decision loops, and toolchains consistent with Hermes Agent deployments. A key trigger point is any confirmed linkage between DeepSeek-based tooling and specific breach campaigns, which would likely accelerate policy responses and procurement restrictions. Another escalation lever would be public attribution or sanctions targeting AI model providers or intermediaries, which could reshape the AI supply chain quickly. Over the next weeks, the timeline to escalation is driven by congressional follow-ups, incident disclosures, and whether “rogue AI-agent breaches” produce repeatable technical signatures that prompt coordinated mitigation.

Geopolitical Implications

• 01

  AI autonomy lowers barriers for cyber offense and increases cross-border disruption risk.

• 02

  US-China mistrust is translating into concrete vendor transparency demands.

• 03

  AI supply-chain governance may become a new compliance battleground with procurement consequences.

• 04

  Credible links between model ecosystems and attacks could trigger export controls and sanctions.

Key Signals

• —DoorDash’s response and whether the inquiry expands to other platforms.
• —Public technical indicators tying Hermes Agent tooling to active intrusions.
• —Regulatory language shifting toward mandatory model documentation and audit rights.
• —Cyber insurance underwriting guidance referencing AI-agent threats.