This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
A threat actor utilized the open-source Hermes AI agent in an unattended 'YOLO' mode to automate post-exploitation activities, including network enumeration and privilege escalation, during an intrusion into Thailand's Ministry of Finance. The activity was discovered by Hunt.io after the operator left logs and attack tooling in publicly accessible web directories. While the agent successfully mapped internal systems and accessed sensitive personnel records, there was no evidence of data exfiltration.
Hunt.io reported that an unidentified threat actor used Nous Research's Hermes agent in unattended "YOLO" mode during an intrusion targeting Thailand's Ministry of Finance. Recovered logs showed Hermes conducting privilege-escalation reconnaissance within ministry systems and recursively searching a directory containing personnel records. Researchers found evidence of compromise but no data exfiltration; the ministry had not publicly confirmed a breach.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to develop cyber weapons (e.g., by coding cheaper, more effective malware), develop new or enhance existing weapons (e.g., Lethal Autonomous Weapons or chemical, biological, radiological, nuclear, and high-yield explosives), or use weapons to cause mass harm.
Also classified as
The AI agent recursively searched and cataloged sensitive personnel records and performance evaluations of ministry staff.
The Hermes AI agent was used by threat actors to automate post-exploitation activities and network scanning during a cyberattack on a government ministry.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The incident was initiated by human threat actors who intentionally deployed the open-source AI agent to automate a cyberattack after its public release.
This incident represents a highly novel escalation in cyber threat capabilities, where an autonomous open-source AI agent (Hermes) was utilized in YOLO mode to conduct post-exploitation activities against a sovereign government entity. While the overall national security impact remains substantial (Score 3) due to the compromise of Thailand's Ministry of Finance networks, it highlights a critical precedent for autonomous AI-driven cyber-espionage.
The report describes Hermes as an 'autonomous AI agent' that 'runs as a persistent service and can remember information between different task sessions.' Operating in 'YOLO mode,' the agent independently executed commands, explored the network, searched files, and made decisions to achieve the operator's high-level objectives without requiring human approval at each step.
High Risk: The AI system was used to automate post-exploitation activities in a cyberattack against critical government infrastructure (Thailand's Ministry of Finance).
Hermes is an open-source AI assistant and chatbot designed to take instructions and run tasks. In this incident, it was used to autonomously search and catalog files (Content Search) within the compromised network.
The incident is documented in detail by multiple cybersecurity sources with technical specifics, including IOCs, file hashes, and specific CVEs targeted. The role of the Hermes AI agent is explicitly detailed through recovered logs, leaving little ambiguity about its autonomous operation in YOLO mode.
The incident could be viewed purely as a traditional cyberattack where the AI was merely a tool, rather than an AI safety failure, but the autonomous decision-making of the agent in YOLO mode justifies its classification as an AI safety incident.
Technology
Autonomous YOLO Mode
Bypassing human approval let the agent execute malicious commands unchecked.
Self-Hosted Open-Source Agent
The agent runs locally, preventing external vendors from blocking its use.
Lack of Malicious Command Blocks
The agent's blocklist failed to prevent running offensive security scripts.
Data Inputs
Stolen Credentials Provided
The agent was fed active session cookies and passwords to access systems.
Malicious Tooling Input
The operator fed the agent custom scripts like LinPEAS to automate attacks.
Human Factors
Deliberate YOLO Activation
The operator actively disabled safety prompts to run unattended commands.
Malicious Human Operator
An attacker directed the AI agent specifically at the ministry's network.
Process and Methods
Exposed Directory Logs
The operator left the agent's execution logs in a public web directory.
Weak Target Network Defenses
Default credentials and unpatched flaws allowed the agent to succeed.
Management
Poor IT Security Management
Ministry management left default configurations like Hive NONE auth active.
Lack of AI Threat Preparedness
The organization lacked detection mechanisms for rapid AI-driven attacks.
Regulatory Environment
Unregulated Agent Software
No legal frameworks govern the release of powerful autonomous AI software.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
