CYBERSECURITYJuly 24, 20261 min read1 views

Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry

A threat actor deployed the open-source Hermes AI agent in 'YOLO mode' to autonomously execute post-exploitation tasks within the network of Thailand's Ministry of Finance.

Someone installed a popular AI assistant on a rented server, switched off the setting that makes it ask permission before running risky commands, and pointed it at Thailand's Ministry of Finance, which runs the country's treasury and tax collection.

The agent then worked through the ministry's network on its own, checking hosts for ways to gain root access, hunting through file systems, and crawling a folder of staff personnel records going back to 2012.

The operator left the agent's own logs sitting on a web server with directory listing switched on, where threat intelligence firm Hunt.io and researcher Bob Diachenko found them, along with 585 files and 470 MB of attack tooling.

The tool is Hermes, an open-source assistant from Nous Research that people install to manage their mail, run chores, and take instructions over Telegram or Slack. It is not a hacking tool, and nothing here is a flaw in it.

The mode the operator used, called YOLO, is a documented feature with its own command-line flag. That is what separates this case from the AI-assisted attacks reported so far.

When Anthropic disclosed a Chinese group using Claude Code for espionage last November, the attackers had to trick the model into cooperating, and Anthropic banned their accounts once it noticed. Hermes runs on the operator's own machine. No vendor was watching, and there was no account to ban.

The operator was already inside before the agent started. Hunt.io recovered a hidden web shell planted on a ministry web server, scripts written against named internal Hadoop systems, and stolen mailbox passwords hardcoded into a mail-testing script.

Source: The Hacker News

More in this category

cybersecurity

Ubuntu snap-confine Flaw Could Give Local Users Root on Default Desktop Installs

Cybersecurity researchers have disclosed details of a high-severity local privilege escalation flaw (CVE-2026-8933) in Ubuntu's snap-confine component. The vulnerability allows unprivileged local users to obtain root access on default Ubuntu Desktop installations by exploiting race conditions during sandbox setup.

cybersecurity

Hackers Exploit Windmill Flaw to Read Arbitrary Server Files Without Authentication

A high-severity path traversal vulnerability in the open-source platform Windmill (CVE-2026-29059) is actively being exploited to read arbitrary server files. CISA has also added several other actively exploited flaws, including critical WordPress vulnerabilities, to its Known Exploited Vulnerabilities catalog.

cybersecurity

Qilin Ransomware Attackers Exploit PAN-OS Authentication Bypass for Initial Access

Threat actors associated with Qilin ransomware are exploiting a critical PAN-OS vulnerability to gain initial access to enterprise networks and deploy ransomware payloads.

cybersecurity

FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware

Cybersecurity researchers have uncovered a massive campaign named FakeGit, leveraging thousands of malicious GitHub repositories to distribute SmartLoader malware. The campaign features a novel technique called AgentBaiting, which tricks AI agents into executing malicious instructions autonomously.

cybersecurity

OpenSSL HollowByte Flaw Could Freeze Server Memory with 11-Byte TLS Requests

A mere 11-byte TLS request can force an unpatched OpenSSL server to allocate up to 131 KB of memory that is never released. OpenSSL silently patched this "HollowByte" vulnerability without issuing a CVE or security advisory.

cybersecurity

Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT

Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a software supply chain attack.