Hermes AI agent run unattended ('YOLO' mode) to automate post-exploitation at Thailand's Ministry of Finance
Real-world incident23 Jul 2026🗺️ Tool-Using AgentThreat-intel firm Hunt.io and researcher Bob Diachenko reported finding exposed attacker directories (staged on a Hong Kong server, archived 9-13 Jul 2026) showing a threat actor installed the open-source Hermes AI agent, ran it in unattended 'YOLO' mode - the documented flag that removes the human-approval prompt - and delegated post-exploitation to it: the agent reportedly ran a customised LinPEAS, hunted Linux privilege-escalation paths, traversed ministry directories and catalogued Office of the Permanent Secretary staff/personnel records dating to 2012. The Ministry has not confirmed a breach, and investigators say nothing in the recovered files shows data leaving the network.
Root cause — why it happened
An attacker got a foothold inside Thailand's Ministry of Finance network and, instead of typing every command by hand, installed an off-the-shelf AI agent (the open-source 'Hermes') and told it to do the hands-on work. Crucially, they switched on the agent's 'YOLO' mode — a documented setting that removes the 'are you sure?' prompt — so it ran commands entirely on its own. The agent then hunted for ways to gain more control, wandered through the file systems, and catalogued folders of staff personnel records going back to 2012. The whole operation only came to light because the attacker accidentally left their own working folders open on a public server for anyone to find.
Risks this case illustrates
Named in the standard (OWASP/ATLAS/NIST) lens. Click a highlighted component in the diagram below to see which risks attach where.
How it unfolded
A foothold, then an AI agent is installed to run the intrusion
The attacker first got inside the Ministry's network — how, exactly, isn't known. Rather than doing everything by hand, they installed an open-source AI agent called Hermes. It runs quietly in the background and remembers what it has done across sessions, so it can keep working through a task on its own once it's pointed at a goal.
# open-source Hermes AI agent (released Feb 2026) mode: daemon # persistent; survives across sessions memory: persistent # accumulates context between runs effectors: [shell, filesystem, network] identity: <compromised host's standing privileges> # operator will now hand it objectives + tooling # (config illustrative, not operational)
Controls & guardrails — what would have stopped it
There's no way to stop an attacker from choosing to run their own AI agent — so the fix isn't about the AI, it's about the network it landed in. Give every account only the access it genuinely needs, so the agent's hunt for more control comes up empty. Wall off parts of the network so a single hacked machine can't spread or quietly send data out. Watch for the burst of rapid, automated activity an unattended agent produces, and be able to cut off a machine fast. None of this prevents the attempt, but together they keep a foothold from becoming a real breach.
- Least-privilege identity & scoped credentials
Doesn't prevent manipulation — only caps its reach. Hard to get right operationally; over-broad scopes are the common real-world failure.
- Egress allowlisting & DLP on tool argumentsaddressesUnsafe Tool / Code Execution
Allowlists fight an open-ended channel; legitimate-but-broad destinations (any URL fetch, any email) are hard to constrain without breaking usefulness. Encoding can evade naive DLP.
- Per-agent identity & taint-marked messagesaddressesExcessive Agency
Adds coordination overhead and doesn't stop a worker from returning subtly wrong (but well-formed) results that mislead the planner.
- Runtime monitoring & anomaly detection
Detects the anomalous, not the novel-but-subtle; high false-positive rates cause alert fatigue. Always a step behind a sufficiently quiet attacker.
- Full-trace audit logging
Logging is forensic, not preventive — it explains harm after the fact. Useless if no one reviews it or if the materialised context isn't captured.
- Loop/cost circuit-breakers & consistency checksaddressesExcessive Agency
Thresholds are blunt — too tight breaks legitimate long tasks, too loose lets damage accrue first. Catches runaway dynamics, not a single well-formed bad decision.
- Governance: risk assessment, red-teaming & incident response
Process reduces likelihood and speeds recovery but executes no technical control itself; weak follow-through makes it theatre.
Lessons
- ▸ Excessive agency cuts both ways: the human-approval gate the lab teaches you to protect in your own agents is exactly what an attacker deliberately removes ('YOLO'/unattended mode) to gain cheap, machine-speed autonomy.
- ▸ An unguardrailed open-source agent needs no jailbreak and defeats no provider safety layer — so model/provider-level controls contribute nothing, and the entire defence must live in the target environment.
- ▸ Against an autonomous attacker agent, least-privilege and privesc hardening are decisive: an automated LinPEAS-style sweep is only as dangerous as the escalation paths it finds.
- ▸ Segmentation and egress control are what keep an autonomous foothold from becoming a breach — here, per the reporting, deep collection occurred but no exfiltration was observed.
- ▸ Unattended agents emit a behavioural signature — dense, single-principal, machine-speed multi-tool activity — that is a better detection signal than any content filter for this threat.
- ▸ Detection was incidental (the operator left staging directories exposed), and the Ministry has not confirmed a breach — treat all scope, tooling, and attribution details as Hunt.io's reporting, not independently confirmed, and default to an assumed-breach posture.
Proposals & gaps this case surfaced
Non-destructive suggestions for the library — proposed, not adopted.
This case flips the usual question. The lab mostly teaches how to keep YOUR OWN AI agent from doing too much. But here the attacker brought their own AI agent and pointed it at a victim — and because it was a free, open-source tool run without any safety brakes, none of the usual 'make the AI safer' controls apply. The gap: teams need to plan for defending against someone else's autonomous agent, mainly by spotting the burst of rapid, automated activity it creates on their machines.
These surface as proposals across the Control Library and Risk Taxonomy; adopt them by hand when ready.
Sources
- Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged - Hunt.io (Bob Diachenko) ↗
- Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry - The Hacker News ↗
- Hermes AI agent used to automate attack on Thai Finance Ministry - BleepingComputer ↗
- OWASP Top 10 for LLM Applications 2025 — LLM06: Excessive Agency ↗ — Framework mapping: unattended autonomy / removed human gate as the excessive-agency multiplier — here weaponised by the attacker.
- MITRE ATLAS — AML.T0053 AI Agent Tool Invocation ↗ — The technique class for an AI agent invoking tools/effectors autonomously to carry out actions.
Practise the risk class — related scenarios
An ops agent gets one god-mode credential — and one misread wipes production
A coding agent asks to write ./notes.txt — the file it actually overwrites is your SSH keys
A team of agents agrees its way into a confidently wrong answer — and a runaway loop
A text-to-SQL agent runs the model's output straight at the database
A jailbroken agent decomposes one malicious goal into hundreds of harmless-looking steps — and per-step filters never see the attack
A poisoned issue makes the agent lie to the human who approves its actions
Told it's being shut down, an agent reaches for leverage — with no attacker in sight
A fake Sentry error report hijacks a developer's coding agent into running a shell command
A 'safe' dataset preview turns an upload into code execution on the pipeline's workers
A shopping page tells the agent to do something the user never asked for
One click provisions an attacker-configured agent inside your own workspace
Encoded public text is laundered across an agent handoff into an on-chain transfer
An attacker captures the agent's bearer token — and inherits its authority
A forged peer registers on the agent directory — and the planner enlists it
A poisoned web page hijacks a research agent — and the planner acts on its behalf
A GUI agent clicks 'Continue' — but the screen moved, and it lands on 'Send'