Hunt.io Catches an AI Agent Running Unsupervised in a Thai Finance Ministry Breach

A threat actor used the open-source Hermes AI agent in unattended “YOLO” mode to automate post-exploitation work during an alleged breach of Thailand’s Ministry of Finance, according to a report from BleepingComputer. Threat intelligence firm Hunt.io and security researcher Bob Diachenko found the activity after they came across exposed web directories holding the operator’s own attack logs, giving a rare direct look at how an autonomous AI agent behaves inside a live, human-directed intrusion rather than a controlled test. The ministry, which runs Thailand’s treasury and tax collection, has not confirmed a breach.

What Was Sitting in the Open

Between July 9 and July 13, Hunt.io found three simultaneously exposed directories on a server hosted in Hong Kong, left with directory listing switched on. The Hacker News reports the directories held 585 files, about 470 MB in total, including exploit code, web shells, HTTP tunneling tools, custom scripts, stolen credentials, compiled payloads, and the Hermes agent’s own session logs. The recovered files named Ministry of Finance systems, hostnames, and internal IP addresses outright, with scripts aimed at the ministry’s Hadoop infrastructure, its Apache Ambari management console, a GlassFish administrative panel, and internal mail servers, the last tested with hardcoded email and password combinations. Some of the Hadoop-facing scripts counted on a specific misconfiguration: HiveServer2 running with authentication set to none, which would let anyone who can reach it install a malicious user-defined function and run operating-system commands through ordinary database queries, a technique Cloudera’s own documentation warns can let an attacker execute arbitrary code as the Hive service account. Hunt.io also recovered a hidden PHP web shell already planted on a ministry web server, disguised at a path built to look like a routine system cache file. A shared TLS certificate fingerprint tied the staging server to two more attacker-controlled hosts, one in Malaysia and one in Hong Kong, and a command-and-control address embedded in a recovered implant linked one of those hosts back to the same operation.

An Undocumented Implant Alongside the AI Agent

The exposed directories also contained Windows and Linux builds of a previously unknown Go-based implant the operator named Hades. Hunt.io examined one Windows build and one Linux build out of 62 total compiled copies and confirmed the two it checked shared the same codebase; the other 60 copies were not individually analyzed. No recovered artifact shows Hades actually reaching a ministry machine. Separate scripts tested default credentials against the ministry’s internal GlassFish console, though nothing confirms the attempts succeeded, alongside older exploit code for flaws in polkit, sudo, and IIS 6.0.

How Hermes Ran Without a Human in the Loop

The centerpiece of the find was a set of logs from Hermes, an open-source AI agent from Nous Research released in February 2026 that ordinary users install to manage email, run errands, and take instructions over Telegram or Slack. It runs as a persistent service and can remember information across task sessions. Hermes is not built as an offensive security tool, and The Hacker News notes that nothing about this incident points to a flaw in the software itself. What the operator used instead was a documented, ordinary setting called YOLO mode, which strips out the prompts that would otherwise ask a person to approve risky commands before Hermes runs them. Nous Research offers three ways to turn it on: a --yolo flag at launch, a /yolo command mid-session, or a HERMES_YOLO_MODE=1 environment variable, and its own configuration guidance says to use it “only in trusted, sandboxed environments.” One safeguard survives YOLO mode regardless: a hardline blocklist that still refuses commands that would wipe the machine Hermes itself is running on.

Five recovered call logs show the operator pointing Hermes at real reconnaissance and privilege-escalation work: finding a path to root, scanning for kernel vulnerabilities, enumerating services, hunting for SUID and SGID binaries, inspecting containers, and walking file systems. For the kernel scan, the operator handed Hermes a customized build of LinPEAS, a standard Linux privilege-escalation enumeration script, checking for four 2026 kernel flaws nicknamed Copy Fail (CVE-2026-31431), Dirty Frag (CVE-2026-43284 and CVE-2026-43500), and DirtyClone (CVE-2026-43503). Each can hand a local user root access where its prerequisites hold, which for Dirty Frag and DirtyClone means having the CAP_NET_ADMIN capability. All four were already weeks old by the time the operator staged them, and nothing recovered names a ministry kernel version or confirms any of the four actually ran. In a separate task, the operator told Hermes to recursively search a web directory tied to the ministry’s Office of the Permanent Secretary for Finance; the agent cataloged PDF, DOC, and XLS files, including staff performance assessments and personnel records dating back to 2012, though Hunt.io found no evidence any of those files left the network.

The reporting on both sides is explicit that Hermes did not choose its own target. The exposed logs show a human operator supplying the objectives and the tooling, while YOLO mode let the agent carry out the resulting reconnaissance and enumeration commands without waiting for approval at each step.

A Different Shape of AI-Assisted Attack

The Hacker News frames this case as distinct from the AI-assisted intrusion Anthropic disclosed last November, when Anthropic reported that a group it assessed with high confidence was Chinese state-sponsored had jailbroken Claude Code to carry out roughly 80 to 90 percent of an espionage campaign against about 30 organizations autonomously. In that case, the attackers had to defeat Claude’s own safety guardrails to get it to cooperate, and Anthropic, watching its own product’s usage, caught the pattern and banned the accounts involved. Hermes runs locally on hardware the operator controls, and YOLO mode is not a jailbreak of anything: it is a documented feature working exactly as designed. There was no vendor traffic to monitor and no account to suspend.

What’s Confirmed and What Isn’t

Thailand’s Ministry of Finance has not confirmed that its systems were breached, and some of the recovered artifacts show only that particular systems were targeted rather than successfully compromised. Hunt.io and Diachenko notified Thailand’s national CERT and its national cybersecurity agency on July 15; as of July 24, when The Hacker News checked, neither had published anything about the incident. BleepingComputer separately contacted the ministry and ThaiCERT for comment and had not received a response at the time of its report. How the attackers first gained access to the ministry’s network at all remains unknown.