Hunt.io Finds Attacker Ran Nous Research's Hermes AI Agent Unattended Against Thailand's Finance Ministry

Overview

A threat actor ran the open-source Hermes AI agent in unattended “YOLO” mode to automate post-exploitation activity during an alleged breach of Thailand’s Ministry of Finance, according to BleepingComputer. The activity was uncovered by threat intelligence company Hunt.io and security researcher Bob Diachenko, who found three simultaneously exposed web directories on a server hosted in Hong Kong containing 585 files totaling approximately 470 MB, according to BleepingComputer.

What We Know

Hermes is “an open-source assistant from Nous Research that people install to manage their mail, run chores, and take instructions over Telegram or Slack,” according to The Hacker News, which noted the tool itself is “not a hacking tool, and nothing here is a flaw in it.” BleepingComputer reported that Hermes is an open-source AI agent released in February 2026 that operates as a persistent service and maintains information across task sessions.

The operator enabled the agent’s “YOLO” mode, which BleepingComputer said “removes approval prompts for dangerous commands, enabling unattended autonomous operation.” The Hacker News detailed how the setting can be triggered: “Hermes offers that setting three ways: a —yolo flag at launch, a /yolo command mid-session, or a HERMES_YOLO_MODE=1 environment variable,” per The Hacker News.

Five recovered call logs showed the agent was tasked with privilege escalation enumeration, kernel vulnerability scanning, service enumeration, and file system traversal, running “a customized LinPEAS script against Ministry of Finance systems,” according to BleepingComputer. The Hacker News described the five logs in more detail: “kernel vulnerability scanning against a ministry host, a second LinPEAS run, a sweep for elevated-permission binaries, a filesystem listing, and a recursive crawl of the web root belonging to the Office of the Permanent Secretary,” per The Hacker News.

The customized LinPEAS script checked for three families of 2026 Linux kernel flaws — “Copy Fail (CVE-2026-31431), Dirty Frag (CVE-2026-43284 and CVE-2026-43500), and DirtyClone (CVE-2026-43503),” according to The Hacker News — alongside exploit code for three older flaws in polkit, sudo, and IIS 6.0, with CVE-2021-4034 explicitly tied to the polkit flaw. Systems referenced in the exposed materials included Hadoop infrastructure, Apache Ambari, and a GlassFish administrative console, and scripts tested authentication against ministry mail servers using hardcoded credentials, according to BleepingComputer.

The exposed directories also contained Windows and Linux builds of a previously undocumented Go-based implant the operator calls Hades, according to both BleepingComputer and The Hacker News. The Hacker News reported that a hidden web shell was planted directly on a ministry web server, at the path “/storage/Counter/nine/.journald-cache.php,” and that the same staging server “previously hosted a ShadowPad controller and now runs a VShell command-and-control listener.”

Hunt.io said the recovered session files, deployed web shells, and evidence of access to internal systems “indicate that the attackers compromised multiple systems within the ministry’s network,” according to BleepingComputer, though the outlet also reported that “the Ministry of Finance has not confirmed a breach occurred.” The agent cataloged PDF, DOC, and XLS files, including performance assessments and personnel records dating back to 2012, from the Office of Permanent Secretary for Finance, per BleepingComputer. Both outlets reported no sign the data left the network: BleepingComputer cited no evidence of exfiltration, while The Hacker News reported that “nothing in the recovered files shows data leaving the network.”

The exposed staging server was hosted in Hong Kong at an address tied to “Converged Communications Limited,” according to BleepingComputer, and The Hacker News reported that the operator’s own SSH session into that server also originated from a separate Hong Kong address. The Hacker News added that the agent’s web interface password contained the Chinese word “Leishen,” meaning “thunder god,” and that Hunt.io “assesses with low-to-medium confidence that the operator is Chinese-speaking or fluent in the language.”

Hunt.io and Diachenko notified ThaiCERT and Thailand’s National Cyber Security Agency on July 15, and both organizations acknowledged receiving the notification that day, according to BleepingComputer. As of The Hacker News’ own check on July 24, “neither had published anything” about the incident.

What We Don’t Know

The Hacker News reported that “how the operator first got in is unknown,” leaving the initial point of entry into the ministry’s network unconfirmed. Neither outlet found evidence that the Hades implant was actually executed on the ministry’s own systems, as opposed to being staged among the attacker’s tooling on the Hong Kong server. The Ministry of Finance has not issued a public confirmation that any of its systems were compromised, and Hunt.io’s attribution to a Chinese-speaking operator remains a low-to-medium-confidence assessment rather than a firm identification of any specific group.

Context

Hermes has drawn attention before: Nous Research shipped its Hermes agent v0.14 foundation release in May, with Nvidia describing it as the most-used agent on OpenRouter. The Thailand incident is also the latest in a string of cases this month where researchers say attackers delegated offensive network tasks to autonomous AI agents; earlier in July, Sysdig documented JadePuffer, which it called the first ransomware attack run end-to-end by an AI agent exploiting a Langflow flaw.