Overview
A confirmed espionage campaign targeting Thailand’s Ministry of Finance has introduced a significant new dimension to the threat landscape: the use of an autonomous open-source AI agent as the primary attack tool. Threat actors deployed Hermes, an open-source agentic AI framework, configured in its unrestricted ‘YOLO mode’ — a setting that removes confirmation prompts and allows the agent to execute tasks autonomously without human approval at each step. The incident marks a notable escalation in the operational use of AI agents by adversaries against government targets.
Technical Analysis
Hermes is an open-source autonomous agent framework designed to complete multi-step tasks by chaining LLM reasoning with tool calls — including web browsing, file system access, code execution, and API interactions. In standard operation, Hermes prompts the user for confirmation before executing potentially destructive or sensitive actions. YOLO mode disables these confirmation gates entirely, allowing the agent to proceed through a full task chain autonomously.
In this attack, the adversaries appear to have leveraged YOLO mode to enable the agent to conduct reconnaissance, exfiltrate data, and potentially move laterally within Ministry of Finance systems without requiring an operator to approve each action in real time. This dramatically reduces the operational overhead for attackers and increases the speed and stealth of the intrusion. The use of an open-source tool also lowers the barrier to attribution and acquisition.
The attack chain likely involved:
- Initial access via conventional means, followed by agent deployment
- Autonomous reconnaissance using Hermes’s tool-use capabilities
- Data collection and exfiltration driven by LLM-generated task planning
- Minimal human operator involvement during execution phases
Framework Mapping
| Framework | Technique | Rationale |
|---|---|---|
| ATLAS | AML.T0047 – ML-Enabled Product or Service | Hermes is an LLM-powered product used as the attack vehicle |
| ATLAS | AML.T0054 – LLM Jailbreak | YOLO mode functionally removes safety constraints, analogous to jailbreaking |
| ATLAS | AML.T0057 – LLM Data Leakage | Agent likely accessed and exfiltrated sensitive government data |
| OWASP | LLM08 – Excessive Agency | Core risk: agent granted unbounded autonomous action capability |
| OWASP | LLM06 – Sensitive Information Disclosure | Government financial data exposed through agent-driven exfiltration |
Impact Assessment
The direct victim — Thailand’s Ministry of Finance — faces potential exposure of sensitive fiscal, budgetary, or policy data. More broadly, this incident signals that autonomous AI agents are now operational tools in state-sponsored espionage, not merely theoretical risks. Any organisation deploying or exposed to agentic AI frameworks faces an expanded attack surface, particularly when those frameworks can be repurposed by adversaries with minimal modification.
Open-source availability of tools like Hermes means the barrier to replicating this attack is low, increasing the likelihood of copycat campaigns.
Mitigation & Recommendations
- Restrict agentic AI deployment: Open-source agent frameworks should be banned or tightly sandboxed within government and critical infrastructure networks.
- Enforce human-in-the-loop controls: Any legitimate agentic AI deployment should require explicit human approval for file access, network calls, and data exports.
- Monitor for agent-like behaviour: Implement behavioural detection for sequential, rapid, LLM-patterned tool invocations that suggest autonomous agent activity.
- Threat-hunt for Hermes IOCs: Security teams should develop signatures for Hermes agent artefacts, logs, and network patterns.
- Review open-source AI tool policies: Establish governance frameworks for which AI agent tools are permitted in sensitive environments.