Hermes AI Agent Run Unattended for Post-Exploitation at Thai Finance Ministry

An attacker ran an open-source AI assistant in fully autonomous mode against Thailand’s Ministry of Finance last month, letting it conduct post-exploitation reconnaissance, hunt for privilege escalation paths, and exploit a database interface without human intervention between steps. Hunt.io published the analysis on July 23, 2026. The case is not the first documented use of an AI agent in a real intrusion, but it is notable for what was absent: no cloud vendor was watching, no API terms were violated, and no account was suspended mid-operation.

The tool was Hermes, built by Nous Research and designed for personal automation tasks such as managing mail and taking instructions via Telegram or Slack. The attacker switched it to YOLO mode and aimed it at a government financial system.

The Hermes Agent and YOLO Mode

Hermes is an open-source project. The YOLO mode feature, activated via --yolo flag, /yolo session command, or environment variable, disables the default requirement that a human approve each risky action before the agent proceeds. The documentation is explicit: use only in trusted, sandboxed environments.

The attacker deployed Hermes on a rented server in Hong Kong (103.97.0[.]57) and pointed it at the Ministry of Finance’s infrastructure, which runs a Hadoop cluster the agent accessed through HiveServer2. SSH sessions originated from the same IP as the web interface hosting Hermes’s results.

This is different from prior AI-assisted attack cases involving commercial model abuse. When operators jailbreak OpenAI or Anthropic APIs to assist with intrusions, vendors can detect anomalous usage patterns and shut down accounts. An attacker running Hermes locally bypasses that oversight layer entirely. The model runs on the attacker’s hardware. No API calls leave to a monitoring provider.

Hunt.io recovered logs showing the agent worked through reconnaissance tasks sequentially, with no evidence of human direction between steps. The attacker set the objective; the agent found its own path to it.

Attack Chain: From Reconnaissance to Personnel Records

The agent’s documented activity followed a recognizable post-exploitation progression.

Initial reconnaissance included kernel vulnerability scanning and binary permission analysis. The attacker provided a customized LinPEAS script targeting four 2026 Linux kernel CVEs: CVE-2026-31431 (Copy Fail), CVE-2026-43284 and CVE-2026-43500 (Dirty Frag), and CVE-2026-43503 (DirtyClone). LinPEAS is a standard privilege escalation enumeration tool; this customized version had specific CVE checks compiled in, suggesting the operator prepared it before deployment.

The database exploitation path used HiveServer2, Apache Hive’s SQL query interface. In its default authentication mode, HiveServer2 accepts any submitted password. The attacker’s script (hive_rce_py2.py) connected to port 10000 and installed HiveCmd.jar as a Hive user-defined function. UDFs in Hive execute on the server as operating system commands. Once registered, arbitrary OS command execution was available via standard HQL query syntax.

From there, the agent enumerated file systems and directory structures, ultimately reaching the Office of the Permanent Secretary’s personnel records, which included staff data dating to 2012. Hunt.io’s analysis found no evidence of data exfiltration, though the access was confirmed.

Infrastructure and Attribution

Several artifacts from the recovered staging server and attack logs point toward a Chinese-language operator.

The web interface password contained the term “Leishen,” a Chinese word for thunder god. A FOFA asset-search service API key was present in the configuration; FOFA is a Chinese internet asset discovery platform comparable to Shodan, widely used in threat actor reconnaissance workflows. Prior hosting history for 103.97.0[.]57 included ShadowPad malware controllers and VShell command-and-control listeners, both tools with documented use in China-nexus intrusion operations.

A previously undocumented Go implant named Hades was found in 62 copies on the staging server. Hunt.io did not publish full technical details on Hades at time of writing.

Hunt.io assessed attribution at low-to-medium confidence for a Chinese-language operator and declined to name a specific threat group. The circumstantial case is consistent but not conclusive.

What the Logs Revealed About Detection Opportunities

Several artifacts from this campaign are actionable for defenders.

A PHP webshell was planted at /storage/Counter/nine/.journald-cache.php, designed to mimic Linux systemd journal cache files. Filename-based detection looking for .php extensions in paths that resemble system service files will catch this class of camouflage.

The /hermes-results/ directory is a default artifact of Hermes deployments. Hunt.io scanned internet-facing hosts after the incident and found approximately 575 exposed /hermes-results/ directories within one month. Not all are malicious, but exposed instances of Hermes running on non-local infrastructure with YOLO mode enabled represent direct risk. Scanning your own attack surface for this path is a fast check.

HiveServer2 running without authentication on port 10000 is an old misconfiguration with a documented CVE history. The Apache documentation has warned about the default behavior for years. Audit any Hadoop deployments for this condition.

The sequential tool call pattern from a single source IP with no meaningful dwell time between actions, characteristic of autonomous agent operation, differs from human operator behavior. SIEM rules correlating multiple tool executions (privilege escalation checks, database client connections, directory enumeration) from a single source within a compressed time window can flag autonomous scanning that human attackers would spread across hours.

Implications for Defenders

The Hermes case demonstrates something the AI security community has discussed theoretically for some time: capable, autonomous post-exploitation agents built from open-source components are being used in real operations. The barrier is low. Hermes is publicly available, the YOLO mode is documented, and the only thing stopping an operator from pointing it at a target is access to the target.

Commercial AI providers can suspend accounts when abuse is detected. They cannot control agents that run locally. The oversight gap is structural.

The practical implication for security teams is not to wait for vendor intervention. Detection has to happen on the defender’s side, through network visibility, authentication controls, and behavior-based alerting that does not assume a human is driving every tool. The agent does not take breaks, does not slow down to think, and does not leave obvious human interaction signatures in access logs.

Organisations with Hadoop infrastructure should patch HiveServer2 authentication immediately, without waiting for other remediation priorities. It was a known misconfiguration before this incident. After it, there is no reason to leave it unaddressed.