Hacker Uses Hermes AI Agent Unattended to Breach Thailand Finance Ministry

A threat actor deployed Nous Research's open-source Hermes assistant on a rented server, enabled its YOLO mode, and pointed it at Thailand's Ministry of Finance, where the agent autonomously executed post-exploitation tasks including scanning internal hosts for root access paths, crawling a folder of staff personnel records dating back to 2012, and running port scans against named internal Hadoop systems. Researchers at Hunt.io and security investigator Bob Diachenko discovered the operation after the operator left the agent's logs exposed on a web server with directory listing enabled, recovering 585 files and 470 MB of attack tooling alongside a hidden web shell planted on a ministry server, scripts targeting Hadoop database services that ship accepting any password by default, and stolen mailbox passwords hardcoded into a mail-testing script. The case stands apart from previously reported AI-assisted attacks because the Hermes agent ran locally with no vendor oversight and no account to ban, unlike the Anthropic-disclosed Chinese espionage campaign where attackers had to trick Claude Code into cooperating. Thailand's national CERT and cybersecurity agency were notified on July 15 but had not issued a public statement as of late July 2026, and the initial access vector remains unknown.

The operator did the work that requires human judgment: building a password list from the ministry's own department abbreviations rather than a generic dictionary, embedding shellcode with hardcoded paths into the ministry intranet, and writing Hadoop-specific scripts for named internal systems. Hermes handled the repetitive half: running a scan, parsing the output, deciding what to check next, and executing the next command without operator approval. The commands themselves were unremarkable. LinPEAS, a standard Linux privilege-escalation script, a search for files with elevated permissions, and a directory crawl. A human attacker would type the same commands, but the human would not need to be present for each one.

The YOLO mode that enabled this is a documented feature, not a vulnerability. Hermes exposes it through three controls: a --yolo flag at launch, a /yolo command issued mid-session, and a HERMES_YOLO_MODE=1 environment variable. Because the model runs on the operator's own machine rather than a vendor-hosted platform, no metrics, guardrails, or kill switch apply. The lesson for defenders is less about the AI and more about the underlying weaknesses the agent exploited. The Hadoop service accepting blank or any-submitted credentials is a known default, the stolen mailbox passwords suggest existing credential exposure that organizations can audit using a email breach checker, and Hadoop deployments can be hardened and externally exposed ports verified through routine SSL/TLS inspection and network exposure reviews.