Hermes in YOLO mode: an AI agent handled post-exploitation in an alleged Thai ministry breach

Someone pointed an open-source AI agent at Thailand’s Ministry of Finance and then walked away from the keyboard. That’s the finding in a July 23 report from threat-intel firm Hunt.io, which recovered the agent’s own logs from three exposed directories on a Hong Kong server. The ministry hasn’t confirmed a breach.

Automation inside intrusions is decades old. Attackers have scripted their scanners since long before anyone said “agentic.” The new part is that the thing choosing which post-exploitation command to run next was a language model, improvising against a live government network with nobody clicking approve. Hunt.io is blunt about how ordinary the toolkit was: “Most of the tools here are ones we have seen before. The combination is what stands apart.” That combination is what should worry defenders: it drops the skill floor for whoever rented the server.

What we know

Hunt.io worked the case with researcher Bob Diachenko, and the pair archived three open directories on one host between July 9 and July 13: 585 files and roughly 470 MB of exploit code, web shells, stolen credentials and agent logs, per the report. Five logs came from Hermes, the open-source agent Nous Research released in February 2026, which runs as a persistent daemon and carries memory between sessions.

What those five logs captured, per Hunt.io:

• A privilege-escalation sweep. The agent scanned a ministry host for kernel bugs, checking three 2026 CVEs including CVE-2026-43503.
• Two LinPEAS runs. Ordinary Linux enumeration, with the agent reading its output back and picking its next move.
• SUID/SGID hunting and container listing. One session died on a broken pipe when the output overflowed.
• A recursive walk of a ministry web root. The Office of the Permanent Secretary directory, holding PDFs and personnel records dating to 2012.
• A PHP web shell planted on a ministry server, named with a leading dot so it read as a journald cache file.

The approval gate was off. “Hermes output logs show the operator ran the agent in unattended or YOLO mode, bypassing approval prompts for commands that could be considered dangerous,” Hunt.io wrote. YOLO is a documented Hermes feature, reachable through a --yolo flag or an environment variable, and the project’s own security docs say where it belongs: “Use only when you fully trust the commands being generated (e.g., well-tested automation scripts in disposable environments).” A ministry network is the opposite of that. The setting developers flip to stop babysitting their agent is what made this one useful to an intruder. OpenAI’s own model breaking out of a test sandbox three days earlier was a lab result. Here the operator turned the guardrail off on purpose.

Hunt.io also documented an unreported Go backdoor the operator calls Hades, built for Windows and Linux, with traffic disguised as requests for /assets/app.min.js. Its kill-date variable and working-hours schedule are deliberate opsec, and a separate script went after Apache HiveServer2 for RCE.

What we don’t know

Plenty. The report is careful about its own limits, and the gaps are wide:

• Whether the ministry was actually breached. Cookie jars and captured output prove network reach, but some artifacts show systems targeted rather than owned. The ministry hasn’t confirmed anything publicly.
• How the operator got in. Initial access is unknown. A GlassFish WAR script and the HiveServer2 exploit were staged, with no confirmation either was used.
• Whether the personnel files left the network. “There is no evidence the files were exfiltrated,” the report states.
• Which model drove the agent. Hunt.io names neither the LLM behind Hermes nor where inference ran.
• Who did it. Hunt.io puts low-to-medium confidence on a Chinese-speaking operator, citing a “Leishen” password on the agent’s web interface, a FOFA key and Hong Kong hosting.

One gap matters most, because the “machine speed” framing is already stuck to this story. The report gives no timings and no command counts. How much faster this ran than a human doing the same work by hand isn’t in the evidence.

The research is a joint effort by Hunt.io and Bob Diachenko, published July 23 after Thailand’s NCSA was notified on July 15 and acknowledged the same day. BleepingComputer carried it first and said neither the ministry nor ThaiCERT answered its questions before publication. The Hacker News and Security Affairs followed on July 24. On r/hermesagent, a reader who checked the source argued the coverage overstates the autonomy: Hermes was only the harness and Hades held the ground.

What this means for you

If you run agents yourself, the fix is the dull one the Hermes docs already spell out. Auto-approve belongs in a throwaway container, never on a host holding credentials or reaching production. Agents can also be talked into bad behaviour, as six of them were by a fake browser game.

For detection, Hunt.io’s mitigations are cheap. Audit web roots recursively for PHP files using leading-dot names that imitate system caches. Alert when a web server process opens outbound connections to internal service ports such as 10000 or 50070. Review HiveServer2 authentication modes and patch sudo and polkit if CVE-2021-3156 or CVE-2021-4034 is still open anywhere. Those are the same tripwires an unassisted intruder crosses, and hardcoded secrets like the GitHub admin token in a Hanwha camera remain a likelier way in.

My read: the report never measures the speed, so treat “AI-speed attack” detection pitches as ahead of the evidence. Watch for case two.