Threat Actor Reportedly Used Hermes AI Agent for Unattended Post-Compromise Activity in Thailand's Ministry of Finance Network

Hunt.io reported that an unidentified threat actor used Nous Research's Hermes agent in unattended "YOLO" mode during an intrusion targeting Thailand's Ministry of Finance. Recovered logs showed Hermes conducting privilege-escalation reconnaissance within ministry systems and recursively searching a directory containing personnel records. Researchers found evidence of compromise but no data exfiltration; the ministry had not publicly confirmed a breach.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.2 Cyberattacks, weapon development or use, and mass harm

The Hermes AI agent was used by threat actors to automate post-exploitation activities and network scanning during a cyberattack on a government ministry.

Additional risk subdomains

• 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information: The AI agent recursively searched and cataloged sensitive personnel records and performance evaluations of ministry staff.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The incident was initiated by human threat actors who intentionally deployed the open-source AI agent to automate a cyberattack after its public release.

EU AI Act risk tier

• Risk tier: 2 High Risk

High Risk: The AI system was used to automate post-exploitation activities in a cyberattack against critical government infrastructure (Thailand's Ministry of Finance).

AI system and alleged parties

• AI system: Hermes (Nous Research)
• AI purpose: Chatbot; Content Search
• Behaviour type: Agent
• Alleged developer: Nous Research, AI agent system developers
• Alleged deployer: Threat actors, hackers, Cybercriminals, AI agent system deployers, Agentic threat actors
• Alleged harmed parties: Thailand Ministry of Finance, Privacy, National security and intelligence stakeholders, Information security, Governments, Government of Thailand, Government agencies

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Minor. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Minor, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Minor, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Civil rights

Reported: The report describes unauthorized access to sensitive personnel records, which constitutes a violation of privacy and civil rights.

Directly caused: The AI agent recursively searched and cataloged personnel records and performance evaluations dating back to 2012.

Inferred additional harm: The unauthorized access to these records likely compromised the data privacy rights of hundreds of government employees.

Privacy

Reported: The report explicitly describes unauthorized access to sensitive personnel files and credentials.

Directly caused: The AI agent accessed and cataloged personnel records, performance assessments, and credentials of the Ministry of Finance.

Inferred additional harm: It is highly likely that the personal data of thousands of ministry employees was exposed to the threat actors, even though no active exfiltration was confirmed in the logs.

People affected

• Occurrences reported: 1

Potential causes

Management

• Poor IT Security Management: Ministry management left default configurations like Hive NONE auth active.
• Lack of AI Threat Preparedness: The organization lacked detection mechanisms for rapid AI-driven attacks.

Technology

• Autonomous YOLO Mode: Bypassing human approval let the agent execute malicious commands unchecked.
• Self-Hosted Open-Source Agent: The agent runs locally, preventing external vendors from blocking its use.
• Lack of Malicious Command Blocks: The agent's blocklist failed to prevent running offensive security scripts.

Data Inputs

• Stolen Credentials Provided: The agent was fed active session cookies and passwords to access systems.
• Malicious Tooling Input: The operator fed the agent custom scripts like LinPEAS to automate attacks.

Human Factors

• Deliberate YOLO Activation: The operator actively disabled safety prompts to run unattended commands.
• Malicious Human Operator: An attacker directed the AI agent specifically at the ministry's network.

Process and Methods

• Exposed Directory Logs: The operator left the agent's execution logs in a public web directory.
• Weak Target Network Defenses: Default credentials and unpatched flaws allowed the agent to succeed.

Regulatory Environment

• Unregulated Agent Software: No legal frameworks govern the release of powerful autonomous AI software.

Information quality

• Classification confidence: High
• Reason for confidence: The incident is documented in detail by multiple cybersecurity sources with technical specifics, including IOCs, file hashes, and specific CVEs targeted. The role of the Hermes AI agent is explicitly detailed through recovered logs, leaving little ambiguity about its autonomous operation in YOLO mode.
• Ambiguities identified: The exact method of initial access by the threat actors remains unknown, and while logs show the AI agent cataloged sensitive files, it is not fully certain whether any data exfiltration occurred off-camera.
• Alternative interpretations: The incident could be viewed purely as a traditional cyberattack where the AI was merely a tool, rather than an AI safety failure, but the autonomous decision-making of the agent in YOLO mode justifies its classification as an AI safety incident.

This incident represents a highly novel escalation in cyber threat capabilities, where an autonomous open-source AI agent (Hermes) was utilized in YOLO mode to conduct post-exploitation activities against a sovereign government entity. While the overall national security impact remains substantial (Score 3) due to the compromise of Thailand's Ministry of Finance networks, it highlights a critical precedent for autonomous AI-driven cyber-espionage.

• Overall national security impact: Substantial
• Scope: Single nation
• Primary target: Thailand
• Alleged perpetrator: Unknown

Threat characteristics

• Imminence: Long-term. The incident has been discovered and mitigated, representing an ongoing strategic concern regarding autonomous cyber capabilities rather than an active crisis.
• Autonomy: Full autonomy. The Hermes AI agent operated in YOLO mode, autonomously executing network scans, vulnerability checks, and file searches without human oversight.
• Novelty: First-of-its-kind. Marks one of the first documented instances of an open-source autonomous AI agent being deployed in YOLO mode to conduct post-exploitation cyber-espionage.

Impact by dimension

• Physical security: Negligible. No physical systems, kinetic capabilities, or critical infrastructure controls were affected or targeted during this cyber-espionage incident.
• Information security: Substantial. The autonomous AI agent successfully mapped internal networks and accessed sensitive personnel records of a government ministry, representing a notable intelligence compromise.
• Sovereignty: Substantial. An autonomous cyber intrusion successfully targeted and mapped Thailand's Ministry of Finance, representing a notable compromise of core government administrative networks.
• Economic security: Minor. While the target was the Ministry of Finance, there was no reported disruption to financial systems, economic manipulation, or strategic technology theft.
• Societal stability: Minor. Unauthorized access to personnel records violated privacy rights of ministry employees, but did not cause widespread societal instability or human rights abuses.