AI Agent Hermes Ran an Unattended Attack on Thailand's Finance Ministry in YOLO Mode

Researchers from Hunt.io and Bob Diachenko have described an unusual case: post-exploitation inside the network of Thailand's Ministry of Finance — which handles the treasury and tax collection — was carried out not by a human but by an AI agent left to run on its own.

The operator installed Hermes on a rented server — an open-source assistant from Nous Research that is normally used to sort through email, handle routine tasks and take commands via Telegram or Slack. It is not a hacking tool, and there is no vulnerability in it. The key detail was its documented YOLO mode, which turns off the confirmation prompt before running risky commands. That is exactly what sets this case apart from earlier AI stories: when Anthropic reported in November that Claude Code had been used by a Chinese group, the model had to be tricked, and the accounts were then blocked. Hermes, on the other hand, runs on the operator's own machine — there is no one to watch or block it.

What the agent did

The human handled the part that requires knowledge of the target: a web shell on the ministry's server, stolen mailbox passwords, a password dictionary assembled from the abbreviations of departmental units, and shellcode with paths into the internal network hardcoded in. The agent, meanwhile, took on the monotonous work: launch a scan, read the output, decide what to check next, launch it again.

Five log files show what it was up to: scanning the host kernel for vulnerabilities, two runs of LinPEAS (the standard script for finding privilege-escalation paths), searching for binaries with elevated permissions, enumerating the file system, and a recursive walk of the web root belonging to the office of the permanent secretary. That folder held internal documents, performance reviews and personnel files of employees dating back to 2012. The logs record the agent reading the directory, but do not show that any files were exfiltrated anywhere.

The linpeas.sh script it was handed had been reworked to target four fresh Linux kernel vulnerabilities from 2026. None of them, judging by the recovered data, ever fired — just as it remains unknown how the operator got inside in the first place.

The road into Hadoop

The main body of code landed on the ministry's Hadoop cluster. The script connected to HiveServer2 on internal port 10000 and sent a password — and Hive by default accepts any password, since its authentication mode is set to NONE. A malicious Java module was then installed as a user-defined function, allowing OS commands to be executed through ordinary SQL queries.

The trail points to Hong Kong and the Chinese language: an SSH session from an address in Hong Kong, a web-interface password containing the word “Leishen” (the god of thunder), and a key to the Chinese service FOFA. Hunt.io assesses with low-to-medium confidence that the operator is a native Chinese speaker, but does not name the group.

What gave everyone away was not a security mechanism but an enabled directory listing: the agent writes its results to a predictable folder, /hermes-results/. No command in the terminal reveals that there is no one at the keyboard — the endpoint sees the same tools it would with a live operator.

Source: The Hacker News