A threat actor used the open-source Hermes AI assistant to automate reconnaissance after breaching Thailand’s Ministry of Finance. Here’s what happened, why it matters, and what defenders should learn from it.
Someone rented a server in Hong Kong, flipped a switch labeled “YOLO,” and pointed an AI agent at Thailand’s Ministry of Finance. What happened next should make every security professional rethink how they view autonomous tools.
On July 24, 2026, The Hacker News published a bombshell investigation. A threat actor had infiltrated Thailand’s treasury and tax collection infrastructure, using Hermes, an open-source AI assistant from Nous Research, to automate post-exploitation tasks once inside. The findings came from threat intelligence firm Hunt.io and security researcher Bob Diachenko, who stumbled upon something remarkable: an attacker so confident they left 585 files and 470 MB of attack tooling sitting on a web server with directory listing enabled.
Here’s the thing. Hermes isn’t malware. It isn’t a hacking tool. Nothing in this incident represents a security flaw in the software itself. Hermes is an open-source assistant that everyday people install to manage their mail, run chores, and take instructions over Telegram or Slack. It was designed to help, not harm.
How the Attacker Weaponized Legitimate Software
The attacker installed Hermes on a rented server and operated it in YOLO mode. Yes, that’s actually what it’s called. You enable it with the `–yolo` flag, a `/yolo` command, or by setting `HERMES_YOLO_MODE=1` as an environment variable. This mode disables the human approval check before running risky commands. The project’s configuration guide explicitly warns to only use this in trusted, sandboxed environments.
But the attacker wasn’t sandboxing anything. They were already inside the ministry network before deploying Hermes, having planted a hidden web shell on a ministry web server. Hunt.io recovered that shell, along with scripts targeting named internal Hadoop systems and stolen mailbox passwords hardcoded into a mail-testing script. The AI agent was simply the automation layer on top of an existing breach.
What the Agent Did While Nobody Was Watching
Once unleashed, Hermes performed repetitive reconnaissance tasks autonomously. The logs show it scanning for kernel vulnerabilities, running LinPEAS for privilege escalation, searching for elevated-permission binaries, listing filesystems, and recursively crawling the web root belonging to the Office of the Permanent Secretary.
That web root held Office documents, performance evaluations, and personnel records dating back to 2012. The agent logs confirm it read the directory. The recovered files show years of government employee data, sitting there since before many current staff were hired. None of the recovered logs show files leaving the network, but the access alone is chilling.
A customized `linpeas.sh` script checked for four 2026 Linux kernel flaws: Copy Fail (CVE-2026-31431), Dirty Frag (CVE-2026-43284 and CVE-2026-43500), and DirtyClone (CVE-2026-43503). None of the recovered material confirms any of these exploits successfully executed. But the attacker was clearly hunting for privilege escalation opportunities, and the AI was doing the hunting for them.
The Clues Pointing East
The operator’s SSH session into the staging server originated from 103.97.0.57 in Hong Kong. The agent’s web interface password contained the Chinese word “Leishen” — thunder god. A key for FOFA, a Chinese asset-search service, was present alongside it.
The same staging server previously hosted a ShadowPad controller and currently runs a VShell command-and-control listener. Hunt.io assessed with low-to-medium confidence that the operator is Chinese-speaking or fluent in the language, though they named no specific threat group. The breadcrumbs were there, but not the attribution.
The Mistake That Caught a Criminal
No safety control exposed this operator. Directory listing did. The attacker left the agent’s logs on a web server with directory listing enabled, like leaving a diary on a park bench with the pages open. Hunt.io found 585 files and 470 MB of attack tooling alongside those logs. The carelessness is almost unbelievable.
The attacker also targeted Hadoop infrastructure aggressively. A script called `hive_rce_py2.py` connected to HiveServer2 on an internal machine at port 10000. Apache documentation states the default authentication mode is NONE, which accepts any password without checking it. Once connected, the script installed a malicious Java add-on called `HiveCmd.jar` as a user-defined function, enabling operating-system commands through database queries. This is vintage enterprise infrastructure exploitation, automated and scaled.
Also recovered was a previously undocumented Go implant named Hades, built for both Windows and Linux in 62 copies. Their hardcoded addresses tie the staging server to a second Hong Kong host. Separate scripts tested default credentials against an internal GlassFish console. This wasn’t a smash-and-grab operation. It was methodical, persistent, and AI-accelerated.
The Safeguards That Worked — and the One That Didn’t
Hermes isn’t completely reckless even in YOLO mode. It offers a hardline blocklist that still refuses commands that would wipe the machine the agent runs on. YOLO mode only disables human approval, not every safeguard. The developers thought about catastrophic scenarios.
Hermes also leaves a detectable trail. Its web panel returns a `HermesWebUI` server header. Hunt.io’s July 23 report found roughly 5,900 scan events referencing that header over a month. The agent writes results to a consistent `/hermes-results/` folder, which returned 575 hits in Hunt.io’s index of exposed directories. If you’re looking for this tool in your environment, you can find it.
Thailand’s national CERT and cybersecurity agency were notified on July 15, 2026. Neither had published anything when The Hacker News checked on July 24, 2026. Ten days of silence while the story broke globally.
Why This Attack Is Different From What Came Before
This incident separates itself from AI-assisted attacks reported previously. When Anthropic disclosed a Chinese group using Claude Code for espionage in November 2025, attackers had to trick the model and Anthropic could ban their accounts. Hermes runs on the operator’s own machine; no vendor was watching and there was no account to ban.
That’s the paradigm shift. Centralized AI services have gatekeepers. Open-source agents installed locally answer to nobody. When the operator flips YOLO mode and points the tool at a target, there is no corporate security team monitoring prompts, no abuse department reviewing logs, no kill switch.
The tool itself remains innocent. Hermes helps people manage their inboxes and schedule their days. But in the wrong hands, with the wrong configuration, it becomes an autonomous reconnaissance engine that never sleeps, never asks questions, and never second-guesses.
Your Takeaway
If you’re defending a network, start hunting for `HermesWebUI` headers and `/hermes-results/` folders today. Check your Hadoop configurations for default NONE authentication. Patch those four 2026 kernel vulnerabilities before someone else checks for them.
And remember: the most dangerous automation tool isn’t the one designed for attack. It’s the legitimate tool operated without the guardrails its creators begged users to respect.