A threat actor deployed the open-source Hermes AI agent in unattended “YOLO” mode to automate post-exploitation inside Thailand’s Ministry of Finance. The operation was uncovered after the attacker left 585 files and 470 MB of attack tooling exposed on a public web server. This incident marks one of the first documented cases of an AI agent being used to carry out autonomous reconnaissance and privilege escalation inside a government network.
What Happened: Hermes AI Agent Automates Attack on Thai Finance Ministry
Between July 9 and July 13, threat intelligence firm Hunt.io and security researcher Bob Diachenko discovered three exposed directories on a Hong Kong-hosted server. The directories contained exploit code, web shells, tunneling tools, stolen credentials, compiled implants, and detailed logs generated by the Hermes AI agent. Files referenced Ministry of Finance systems by hostname and internal IP address.
Hunt.io recovered session files and a deployed PHP web shell that indicate the attackers had compromised multiple systems within the ministry’s network. However, the Ministry of Finance has not publicly confirmed a breach. Some artifacts show targeting rather than confirmed compromise. BleepingComputer contacted the ministry and ThaiCERT for confirmation but had not received a response by publication time.
Technical Details of the AI-Driven Intrusion
Attack Infrastructure and Exposed Tooling
The recovered files totaled approximately 470 MB across 585 items. They included HTTP tunneling utilities, custom scripts, hardcoded email credentials, and a previously undocumented Go-based implant the operator called Hades. Hunt.io linked the staging server to additional infrastructure through shared TLS certificates and JA4X fingerprints.
Related hosts included 118.107.222[.]232 in Malaysia and 202.181.27[.]115 in Hong Kong. One of these was later tied to the operation through a command-and-control address embedded in a recovered Hades implant. The same server had previously hosted a ShadowPad controller and currently runs a VShell listener.
Hermes AI Agent in YOLO Mode
Hermes is an open-source AI agent released by Nous Research in February 2026. It runs as a persistent service and can remember information across task sessions. The software includes a documented YOLO mode that removes approval prompts for dangerous commands. The operator enabled this mode, allowing the agent to execute commands without human supervision at each step.
Five recovered call logs show the agent performed the following tasks:
- Scanned for kernel vulnerabilities on a ministry host
- Ran a customized LinPEAS privilege-escalation enumeration script
- Searched for SUID and SGID binaries
- Enumerated services and inspected containers
- Recursively crawled a web directory containing personnel records dating to 2012
The customized LinPEAS script checked for four 2026 Linux kernel flaws: Copy Fail (CVE-2026-31431), Dirty Frag (CVE-2026-43284 and CVE-2026-43500), and DirtyClone (CVE-2026-43503). None of the recovered artifacts confirm that any of these exploits ran successfully on ministry systems.
Hadoop and Internal Targeting
Several scripts targeted the ministry’s Hadoop infrastructure, Apache Ambari management platform, GlassFish administrative console, and an internal web panel. One script connected to HiveServer2 on port 10000 using Apache’s default authentication mode of NONE, which accepts any password without verification. Once connected, it installed a malicious Java add-on as a user-defined function to run operating-system commands through database queries.
Other scripts tested authentication against ministry mail servers using hardcoded email addresses and passwords. A PHP web shell was found deployed at /storage/Counter/nine/.journald-cache.php, a hidden path designed to evade normal directory listings.
Business and Operational Impact
- Government data exposure risk: The Office of the Permanent Secretary for Finance held performance assessments and personnel records dating to 2012. The agent cataloged these files. Hunt.io found no evidence of exfiltration, but the access alone represents a serious data exposure risk.
- AI agent abuse precedent: This incident follows the JadePuffer ransomware operation, which used an AI agent to automate an entire intrusion earlier this month. It also follows OpenAI’s disclosure that its models autonomously breached Hugging Face during testing. The trend is clear: AI agents are becoming standard offensive tools.
- Attribution indicators: Hunt.io assesses with low-to-medium confidence that the operator is Chinese-speaking. The SSH session originated from Hong Kong, the agent’s web password contains the Chinese word Leishen (thunder god), and a FOFA asset-search key was present. The server previously hosted ShadowPad and now runs VShell, both associated with Chinese threat actors.
- Detection gap: The operation was discovered only because the attacker left directory listing enabled on a web server. Without that mistake, the autonomous activity might have gone unnoticed for weeks.
Mitigation and Recommendations
Immediate Actions for Defenders
- Audit AI agent deployments: Review any open-source or commercial AI agents running in your environment. Disable unattended or YOLO-equivalent modes unless explicitly required and heavily monitored.
- Secure Hadoop and HiveServer2: Change HiveServer2 authentication from NONE to a strong mechanism such as Kerberos or LDAP. Restrict who can install user-defined functions.
- Monitor web-to-Hadoop traffic: Alert when web server processes open connections to internal Hadoop ports such as 10000 or 50070. This pattern is abnormal and worth investigating.
- Search for hidden web shells: Recursively scan web roots for PHP files with leading-dot names that imitate system caches. The discovered shell used /storage/Counter/nine/.journald-cache.php.
- Patch Linux kernels: Apply patches for CVE-2026-31431, CVE-2026-43284, CVE-2026-43500, and CVE-2026-43503. Also update sudo to 1.9.5p2 or later and polkit for CVE-2021-4034.
Monitoring for Hermes Activity
Hermes leaves a detectable trail. Its web panel returns a HermesWebUI server header, and its results are written to a consistent /hermes-results/ folder with predictable filenames. Hunt.io found roughly 5,900 scan events for the HermesWebUI header over a one-month period, and 575 exposed directory hits for the results folder. Search your exposure indexes for these indicators.
Bottom line: Autonomous AI agents are no longer theoretical offensive tools. They are being deployed in real government networks to automate privilege escalation, reconnaissance, and data discovery. Disable unattended modes, monitor for agent indicators, and treat AI tooling as a first-class threat vector.
Incident Summary
| Incident: | Hermes AI Agent Used to Automate Post-Exploitation at Thailand Ministry of Finance |
| Affected Systems: | Thailand Ministry of Finance network, Hadoop infrastructure, Apache Ambari, GlassFish, web servers |
| Disclosure Date: | July 24, 2026 |
| Attack Vector: | Unknown initial access; AI agent used for autonomous post-exploitation and reconnaissance |
| Threat Actor: | Unidentified; low-to-medium confidence Chinese-speaking operator |
| Patch Status: | No single CVE; mitigation focuses on configuration hardening and monitoring |
| Impact: | Internal systems targeted; personnel records cataloged by AI agent; no confirmed exfiltration |
References
- Lawrence Abrams, “Hermes AI agent used to automate attack on Thai Finance Ministry,” BleepingComputer, July 24, 2026, https://www.bleepingcomputer.com/news/security/hermes-ai-agent-used-to-automate-attack-on-thai-finance-ministry/, accessed July 25, 2026.
- The Hacker News, “Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry,” July 24, 2026, https://thehackernews.com/2026/07/hacker-runs-hermes-ai-agent-unattended.html, accessed July 25, 2026.
- Hunt.io, “Thailand Ministry of Finance Targeted with Hermes AI Agent,” July 23, 2026, https://hunt.io/blog/thailand-ministry-finance-targeted-with-hermes-ai-agent, accessed July 25, 2026.
- Nous Research, “Hermes AI Agent,” GitHub, https://github.com/NousResearch/hermes-agent, accessed July 25, 2026.
