A threat actor used the open-source Hermes AI agent in unattended “YOLO” mode to automate post-exploitation activity during an alleged breach of Thailand’s Ministry of Finance.
The activity was uncovered by threat intelligence company Hunt.io and security researcher Bob Diachenko after they discovered several exposed web directories containing hundreds of files associated with the operation.
Hunt.io says session files, deployed web shells, and evidence of access to internal systems indicate that the attackers compromised multiple systems within the ministry’s network.
However, the Ministry of Finance has not confirmed that its systems were breached, and some of the recovered artifacts only show that particular systems were targeted rather than successfully compromised.
BleepingComputer contacted Thailand’s Ministry of Finance and ThaiCERT to confirm the reported attack and will update this story if we receive a response.
Attack infrastructure exposed online
Between July 9 and July 13, Hunt.io discovered three simultaneously exposed directories on a server hosted in Hong Kong.
The directories contained 585 files totaling approximately 470 MB, including exploit code, web shells, HTTP tunneling tools, custom scripts, stolen credentials, compiled payloads, and logs generated by the Hermes AI agent.
The recovered files referenced Ministry of Finance systems by name, hostname, and internal IP address, and included scripts targeting internal services.
Some scripts targeted the ministry’s Hadoop infrastructure, Apache Ambari management platform, GlassFish administrative console, and an administrative web panel. Other scripts tested authentication against ministry mail servers using hardcoded email addresses and passwords.
Hunt.io also found a PHP web shell that it says had been deployed on a Ministry of Finance web server.
The researchers linked the initial server to additional attacker-controlled infrastructure by shared TLS certificates used during the same time period.
“In addition to the common name, all these certificates share a JA4X fingerprint, a hash derived from the structure of the certificate itself rather than its contents,” explained Hunt’s report.
“Querying that hash alongside the www common name in HuntSQL returned two additional, related hosts: 118.107.222[.]232 (The Gigabit, Malaysia) and 202.181.27[.]115 (Converged Communications Limited, Hong Kong).”
One of those servers was later linked to the operation through a command-and-control address embedded in a recovered implant.
The directories also contained Windows and Linux builds of a previously undocumented Go-based implant that the operator called Hades.
However, the more interesting discovery was a collection of logs showing that the attackers used an AI agent, Hermes, to automate parts of the cyberattack against the ministry.
Hermes operating in YOLO mode
Hermes is an open-source AI agent released in February 2026 that runs as a persistent service and can remember information between different task sessions.
The AI agent can interact with tools and execute commands while working on tasks provided by the operator.
The software includes a setting known as YOLO mode, which removes prompts that would require a person to approve dangerous commands.
The researchers were able to recover environment information and Hermes output logs from the exposed directories that showed the operator had enabled this unattended mode. This allowed the agent to execute commands and continue analyzing systems without waiting for human approval at each step.
Five recovered Hermes call logs show the agent was used to find a way to elevate privileges, scan for kernel vulnerabilities, enumerate services, search for SUID and SGID binaries, inspect containers, and traverse file systems.
Hermes was also told to use a customized version of the LinPEAS privilege-escalation enumeration script to collect information from a Ministry of Finance host.
In another task, the operator instructed Hermes to recursively search a web directory associated with the Office of Permanent Secretary for Finance.
The agent cataloged PDF, DOC, and XLS files, including performance assessments and personnel records dating back to 2012. However, Hunt says it found no evidence that these files were exfiltrated.
The findings do not indicate that Hermes independently decided to target the ministry.
Instead, the exposed logs show an operator supplying the agent with objectives and tooling while YOLO mode allowed it to carry out routine post-exploitation commands without constant supervision.
Hunt.io says the recovered artifacts depict an active intrusion in which tools had been staged and access to internal systems was expanding. However, the researchers could not determine how the attackers initially gained access.
The company and Diachenko notified ThaiCERT and Thailand’s National Cyber Security Agency on July 15. According to the report, both organizations acknowledged receiving the notification that day.
This Hermes activity is the latest example of autonomous AI agents being used to conduct cyberattacks.
Earlier this month, the JadePuffer ransomware operation used an AI agent to automate an entire intrusion, including reconnaissance, credential theft, lateral movement, privilege escalation, and data encryption.
Autonomous agents can also cause real-world breaches, even if unintentional.
OpenAI recently disclosed that its models autonomously hacked Hugging Face while undergoing cybersecurity benchmark testing, exploiting zero-day vulnerabilities to escape a sandboxed testing environment and access the internet.
It then used stolen credentials and additional vulnerabilities to breach Hugging Face’s production systems.
Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.
The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection.
Get the whitepaper
