Someone rented a server, installed an open-source AI assistant called Hermes, flipped a switch that makes it stop asking for permission before acting, and pointed it at Thailand's Ministry of Finance. The ministry runs the country's treasury and tax collection. The agent then roamed the ministry's network on its own, checking hosts for root access, hunting through file systems, and crawling a folder of staff personnel records dating back to 2012.
The operator left the agent's logs sitting on a web server with directory listing turned on. Threat intelligence firm Hunt.io and researcher Bob Diachenko found them there, along with 585 files and 470 MB of attack tooling. Hermes is an open-source assistant from Nous Research, designed to manage email, run chores, and take instructions over Telegram or Slack. It is not a hacking tool. Nothing in this case is a flaw in the tool itself. The mode the operator used is called YOLO, a documented feature with its own command-line flag. That is what sets this apart from earlier AI-assisted attacks. When Anthropic disclosed a Chinese group using Claude Code for espionage last November, the attackers had to trick the model into cooperating, and Anthropic banned their accounts. Hermes runs on the operator's own machine. No vendor was watching. There was no account to ban.
The operator was already inside the network before the agent started. Hunt.io recovered a hidden web shell on a ministry web server, scripts written against internal Hadoop systems, and stolen mailbox passwords hardcoded into a mail-testing script. Nothing in the recovered files shows data leaving the network. How the operator first got in is unknown. Thailand's national CERT and cybersecurity agency were notified on July 15. As of July 24, neither had published anything. For everyone else, the useful detail is what the operator's scripts were built to exploit: a Hadoop database service that ships accepting any password by default. The human did the parts that require knowing the target. The agent did the repetitive part: run a scan, read the output, decide what to check next, run another. None of the commands were exotic. What changed is that nobody had to approve each one.
Source: The Hackers News