Reported by 1 outlet
Hermes AI Agent Used to Automate Post-Exploitation in Thai Finance Ministry Attack
Why this score
- Breadth
- 0.50 / 2.0 · 1 source
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.70 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Hermes AI Agent Used to Automate Post-Exploitation in Thai Finance Ministry Attack
bleepingcomputer.com · 81d ago · July 25th, 2026
A threat actor deployed the open-source Hermes AI agent in unattended "YOLO" mode to automate post-exploitation activity during an alleged breach of Thailand's Ministry of Finance. The activity was uncovered by Hunt.io and researcher Bob Diachenko after discovering three exposed web directories on a Hong Kong-hosted server containing 585 files (~470 MB) of exploit code, web shells, HTTP tunneling tools, custom scripts, stolen credentials, compiled payloads, and Hermes AI agent logs.
Recovered files referenced Ministry of Finance systems by name, hostname, and internal IP address. Scripts targeted the ministry's Hadoop infrastructure, Apache Ambari, and GlassFish servers. The Ministry of Finance has not confirmed the breach, and some artifacts only indicate targeting rather than successful compromise.
Significance: This is the first publicly documented case of an open-source AI agent operating in fully unattended mode being used in a real-world attack chain. The YOLO mode setting gives the AI unrestricted decision-making authority over post-exploitation actions, raising urgent questions about how defenders should model AI-enabled threat actors. Defenders should assume AI-assisted intrusion automation will become more common — hunt for anomalous tool execution sequences that lack the pauses and latencies of human interaction.