Hacker Ran Open-Source Hermes AI Agent in Unattended Mode to Automate Post-Exploitation at Thailand's Finance Ministry

A threat actor deployed the open-source Hermes AI agent with its human approval prompts disabled to automate post-exploitation tasks inside Thailand’s Ministry of Finance network, according to research published by threat intelligence firm Hunt.io on July 23 and reported by The Hacker News and BleepingComputer on July 24. The operation is the first publicly documented case of an autonomous agent framework being used operationally in a real intrusion.

What Happened

Between July 9 and 13, Hunt.io and security researcher Bob Diachenko discovered three open directories on a Hong Kong-hosted server (43.246.208[.]207) containing 585 files totaling approximately 470 MB, according to Hunt.io’s report. The files included exploit code, web shells, HTTP tunneling tools, custom scripts with hardcoded stolen credentials, and output logs from the Hermes AI agent.

Hermes is an open-source assistant built by Nous Research, released in February 2026. It runs as a persistent service, executes commands, and can remember information between sessions. It is designed for legitimate tasks like managing email and running chores over Telegram or Slack.

The operator enabled Hermes’s “YOLO mode,” a documented feature activated via a command-line flag, mid-session command, or environment variable. YOLO mode disables the prompts that normally require a human to approve potentially dangerous commands. According to The Hacker News, the Hermes project’s own configuration guide warns users to “only use this in trusted, sandboxed environments.”

What the Agent Did

Five recovered Hermes call logs show the agent performing kernel vulnerability scanning against a ministry host, running a customized version of the LinPEAS privilege escalation script, sweeping for SUID and SGID binaries, enumerating services, and recursively crawling a web directory belonging to the Office of the Permanent Secretary for Finance, according to BleepingComputer.

That directory contained PDF, DOC, and XLS files including performance assessments and personnel records dating back to 2012. The logs show the agent cataloging the files. No evidence of data exfiltration was found, according to Hunt.io.

The customized LinPEAS script checked for four 2026 Linux kernel vulnerabilities across three families: Copy Fail (CVE-2026-31431), Dirty Frag (CVE-2026-43284 and CVE-2026-43500), and DirtyClone (CVE-2026-43503), according to The Hacker News.

The Human Still Drove the Operation

The recovered artifacts show a human operator who already had access to the ministry’s network before the agent started, according to all three sources. Hunt.io recovered a PHP web shell deployed on a ministry web server, scripts built to target named internal Hadoop systems, and stolen mailbox passwords hardcoded into a mail-testing script.

Password lists were constructed from the ministry’s own department abbreviations rather than generic dictionaries, and shellcode carried hardcoded paths into the ministry intranet, according to The Hacker News. The human did the parts that required knowing the target. The agent handled repetitive enumeration.

None of the commands the agent ran were exotic. A person would type the same things. What changed is that nobody had to approve each one.

Contrast With Prior AI-Assisted Attacks

When Anthropic disclosed a Chinese group using Claude Code for espionage last November, the attackers had to manipulate the model into cooperating, and Anthropic banned their accounts once detected, as reported by The Hacker News. Hermes runs on the operator’s own machine. No vendor was watching, and there was no account to ban.

Hunt.io also found a previously undocumented Go-based implant the operator called “Hades,” with both Windows and Linux builds staged on the same server, according to Hunt.io’s report. TLS certificate analysis linked the staging server to two additional attacker-controlled hosts in Malaysia and Hong Kong.

Response

Hunt.io and Diachenko notified Thailand’s national CERT and National Cyber Security Agency on July 15. Both organizations acknowledged receipt the same day, according to Hunt.io. Neither had published a public response as of July 24. The Ministry of Finance has not confirmed a breach, and BleepingComputer noted that some recovered artifacts show systems were targeted rather than confirmed compromised.

The YOLO Mode Problem

Hermes’s YOLO mode retains one safety layer: a hardline blocklist that refuses commands that would destroy the machine the agent runs on. But the human check for everything else is gone, according to The Hacker News.

For teams building or deploying agent frameworks, the architectural question is whether “approval prompts” constitute a real security boundary. In this case, a single flag toggled the difference between a supervised tool and an autonomous one running offensive operations against a government ministry.