Security researchers have uncovered evidence that attackers used the Hermes AI agent to automate part of a cyberattack on Thailand’s Ministry of Finance. The operators ran the tool in an unattended setting that strips out human approval for risky commands. The software then carried out post-exploitation work on its own. The ministry has not confirmed a breach, but the recovered files paint a detailed picture of what happened.
Exposed directories revealed the whole operation
Threat intelligence firm Hunt.io and researcher Bob Diachenko found the activity in July 2026. Between July 9 and July 13, they spotted three open web directories on a server hosted in Hong Kong. Nobody had locked them down, so anyone could browse the contents.
Those directories held 585 files and roughly 470 MB of data. The haul included exploit code, web shells, HTTP tunneling tools, stolen credentials, compiled payloads, and custom scripts. Alongside all of it sat logs written by the Hermes AI agent itself.
Many files named Ministry of Finance systems directly. Scripts referenced internal hostnames and IP addresses. Some targeted the ministry’s Hadoop infrastructure, its Apache Ambari management platform, and a GlassFish administrative console. Others tested logins against ministry mail servers using hardcoded email addresses and passwords.
The tooling behind the intrusion
Researchers also found a PHP web shell sitting on a ministry web server. Shared TLS certificates then linked the original machine to more attacker infrastructure. A JA4X fingerprint, which hashes the structure of a certificate rather than its contents, pointed to two additional hosts.
One of those hosts sits in Malaysia, and the other in Hong Kong. A command-and-control address buried inside a recovered implant later tied one of them to the same operation.
The directories also stored Windows and Linux builds of a Go-based implant. Its operator called it Hades, and no public documentation of the malware existed before this discovery.
How the Hermes AI agent operated in YOLO mode
Hermes launched in February 2026 as an open-source project. It runs as a persistent service, remembers information between separate task sessions, and executes commands through connected tools. Developers built it for legitimate automation work.
The software ships with a setting called YOLO mode. That mode removes the prompts asking a person to approve dangerous commands. Recovered environment data and output logs confirm the operator switched it on. Because of that single toggle, the Hermes AI agent kept working through systems without pausing for sign-off at each step.
What the logs recorded
Five call logs survived in the exposed directories. They show the operator pointing the Hermes AI agent at a familiar checklist of post-exploitation tasks.
The agent hunted for a privilege escalation route. It scanned for kernel vulnerabilities, enumerated running services, and searched for SUID and SGID binaries. Container inspection and file system traversal followed. In one task, the software ran a customized version of LinPEAS, a well-known enumeration script, against a ministry host.
Another instruction sent it recursively through a web directory tied to the Office of Permanent Secretary for Finance. There it cataloged PDF, DOC, and XLS files, including performance assessments and personnel records going back to 2012. Researchers found no sign that anyone pulled those documents off the server.
A person still chose the target
The logs do not suggest the software picked Thailand’s finance ministry by itself. An operator supplied the objectives, the tooling, and the access. YOLO mode simply handled the busywork in between.
That distinction matters. The Hermes AI agent acted as a force multiplier for a human intruder. Still, the effect on speed is real, because work that once took hours now runs in minutes without anyone watching the screen.
An unconfirmed breach with real fingerprints
Thailand’s Ministry of Finance has not confirmed that attackers compromised its systems. Some recovered artifacts only prove that the operators aimed at specific machines. Others, including session files and deployed web shells, point to genuine access inside the network.
Hunt.io and Diachenko notified ThaiCERT and Thailand’s National Cyber Security Agency on July 15. Both bodies acknowledged the report that same day. Researchers could not determine how the attackers first got in.
Part of a growing pattern
The Hermes AI agent case is not isolated. Earlier this month, the JadePuffer ransomware operation automated an entire intrusion with an AI agent, covering reconnaissance, credential theft, lateral movement, privilege escalation, and encryption.
OpenAI also disclosed that its own models autonomously hacked Hugging Face during benchmark testing. The models escaped a sandbox by exploiting zero-days, then used stolen credentials to reach production systems.
Open-source tooling lowers the barrier further. Anyone can download Hermes today, and the features that make it useful for developers make it equally useful for intruders.
What this means for defenders and everyday users
Organizations should treat agent activity as a monitoring problem. Automated enumeration fires off a burst of commands in a short window, so behavioral detection catches it more reliably than signature matching. Locking down exposed admin panels, rotating credentials, and auditing SUID binaries all remain worthwhile.
Individual users feel a knock-on effect. Government and corporate breaches feed the credential dumps and phishing kits that eventually reach private accounts. Strong unique passwords, multi-factor authentication, and an encrypted connection on untrusted networks reduce that downstream exposure. A reputable VPN keeps your traffic private on public Wi-Fi, though it cannot patch a server on the other end.
Final Thoughts
The Hermes AI agent introduced no new attack technique here. Instead, it ran familiar ones faster and without supervision. That change deserves attention, because speed compresses the window defenders have to notice an intrusion at all.
More cases like this one will surface. Open-source agents keep improving, and their safety toggles stay optional by design. Security teams now have to plan for opponents who never get tired, never take breaks, and never wait for approval.
