Overview
A threat actor leveraged the open-source Hermes AI agent — operating in autonomous ‘YOLO’ mode — to automate post-exploitation activity during an alleged intrusion into Thailand’s Ministry of Finance. Discovered by Hunt.io and researcher Bob Diachenko, the operation represents one of the clearest documented cases of an adversary using a production-grade AI agent framework to conduct and manage a cyberattack against a sovereign government entity.
Between 9–13 July 2026, three simultaneously exposed web directories were found on a Hong Kong-hosted server. The directories contained 585 files (~470 MB) including exploit code, PHP web shells, HTTP tunnelling tools, compiled payloads, stolen credentials, and logs generated directly by the Hermes agent.
Technical Analysis
The Hermes AI agent was configured to run without human supervision (‘YOLO’ mode), enabling it to autonomously select and execute attack tasks, interpret results, and pivot between targets. This dramatically compresses the operator’s required dwell time and manual effort.
Recovered artefacts included:
- Web shells reportedly deployed on Ministry of Finance web servers
- Scripts targeting Hadoop infrastructure, Apache Ambari, GlassFish administrative console, and an internal web admin panel
- Credential stuffing scripts authenticating against ministry mail servers using hardcoded email/password pairs
- Session files and internal hostnames/IP addresses confirming the targeting of specific internal systems
Attacker-controlled infrastructure was linked across multiple hosts (Hong Kong, Malaysia, and a Converged Co node) via shared TLS certificates identified through JA4X fingerprint correlation — a structural certificate hash independent of certificate content.
Framework Mapping
MITRE ATLAS:
- AML.T0047 (ML-Enabled Product or Service): Hermes is an open-source AI agent repurposed as an offensive automation layer, exemplifying adversarial use of ML-enabled tooling.
- AML.T0012 (Valid Accounts): Hardcoded credentials and credential stuffing against mail servers indicate use and abuse of valid authentication material.
- AML.T0040 (ML Model Inference API Access): The agent’s autonomous decision loop relies on repeated inference to determine next attack steps.
OWASP LLM Top 10:
- LLM08 (Excessive Agency): Running Hermes in YOLO mode grants the agent unconstrained authority to execute system-level actions without human approval — the canonical excessive agency scenario.
- LLM02 (Insecure Output Handling): Agent-generated scripts and payloads were executed directly against live systems without output sanitisation.
- LLM06 (Sensitive Information Disclosure): Agent logs exposed in the open directories revealed internal hostnames, IPs, and credential material.
Impact Assessment
While the Ministry of Finance has not confirmed a breach, artefacts strongly suggest at least partial network access was achieved. The use of an AI agent to automate post-exploitation is particularly significant: it signals a shift where sophisticated attack campaigns are no longer gated by operator skill or availability. Government ministries with ageing web infrastructure and insufficiently segmented internal services face elevated risk as these tools proliferate.
Mitigation & Recommendations
- Audit administrative consoles (Ambari, GlassFish, Hadoop management interfaces) for unauthorised sessions and anomalous API calls.
- Rotate all exposed credentials referenced in any breach artefacts; enforce MFA on mail and admin systems.
- Implement behavioural detection for AI agent signatures: rapid sequential enumeration, automated script generation, and high-frequency authentication attempts.
- Restrict egress traffic from web servers to prevent agent-assisted lateral movement and data exfiltration.
- Apply JA4X and TLS fingerprinting in threat hunting workflows to correlate attacker infrastructure across campaigns.