In a recent cybersecurity incident, an unidentified individual deployed the open-source AI assistant Hermes on a rented server, disabling its safety prompts to autonomously infiltrate Thailand’s Ministry of Finance. This ministry oversees the nation’s treasury and tax collection systems.
Operating without human oversight, the Hermes agent systematically scanned the ministry’s network, seeking root access, exploring file systems, and accessing personnel records dating back to 2012.
The agent’s activity logs, along with 585 files and 470 MB of attack tools, were inadvertently left exposed on a web server with directory listing enabled. This oversight led to their discovery by threat intelligence firm Hunt.io and researcher Bob Diachenko.
Hermes, developed by Nous Research, is typically used for managing tasks via platforms like Telegram or Slack. The agent’s ‘YOLO’ mode, which allows it to execute commands without user confirmation, was intentionally activated by the operator. This mode is documented and intended for use in controlled environments.
Unlike previous AI-assisted attacks that required tricking models into compliance, this incident involved an AI agent operating independently on the attacker’s infrastructure, eliminating the need for external oversight or account monitoring.
Evidence suggests the attacker had prior access to the ministry’s systems. Hunt.io identified a concealed web shell on a ministry server, scripts targeting internal Hadoop systems, and a mail-testing script containing stolen mailbox passwords.
While no data exfiltration has been confirmed, the initial breach method remains unknown. Thailand’s national CERT and cybersecurity agency were informed on July 15 but had not released any statements as of July 24.
Notably, the attack exploited a Hadoop database service configured to accept any password by default. The attacker’s scripts utilized password lists derived from the ministry’s department abbreviations and included shellcode with hardcoded paths into the ministry’s intranet.
The Hermes agent executed standard commands such as LinPEAS for privilege escalation detection, searches for files with elevated permissions, and directory crawls. These tasks, typically performed manually, were automated by the agent without requiring human approval.
Hermes offers multiple methods to enable ‘YOLO’ mode, including a command-line flag, an in-session command, or an environment variable. The project’s configuration guide advises using this mode only in trusted, sandboxed environments. Despite this, a hardline blocklist remains active to prevent commands that could compromise the agent’s host machine.
This incident underscores the evolving landscape of cyber threats, where AI agents can be weaponized to conduct autonomous attacks. Organizations must reassess their security protocols to address the potential misuse of AI tools and ensure that default configurations do not inadvertently expose systems to exploitation.
