Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry
12:15 · July 24, 2026 · Hacker News AI Section
Someone installed a popular AI assistant on a rented server, switched off the setting that makes it ask permission before running risky commands, and pointed it at Thailand's Ministry of Finance, which runs the country's treasury and tax collection. The agent then worked through the ministry's network on its own, checking hosts for ways to gain root access, hunting through file systems, and
Summary
An operator installed the open-source Hermes assistant from Nous Research on a rented server and enabled its YOLO mode, which disables confirmation prompts for potentially dangerous commands. The agent was then directed at Thailand’s Ministry of Finance, where it autonomously executed post-exploitation tasks already prepared by the human operator. It ran LinPEAS scans to identify privilege-escalation paths, searched for files with elevated permissions, listed directories, and recursively examined the web root of the Office of the Permanent Secretary, where it encountered personnel records and performance evaluations dating back to 2012.
The operator had established initial access beforehand, including a web shell on a ministry server, custom scripts targeting internal Hadoop systems, and hardcoded mailbox credentials. Most of the custom tooling focused on the ministry’s Hadoop cluster. A script named hive_rce_py2.py connected to HiveServer2 on port 10000 and exploited the service’s default authentication mode of NONE, which accepts any supplied password. Once connected, the script deployed a malicious Java user-defined function that allowed operating-system commands to be executed through ordinary database queries.
Hermes itself introduced no new vulnerabilities or target selection; it performed the repetitive sequence of running a command, interpreting the output, and deciding on the next step. All observed actions used common utilities rather than novel exploits. Because the agent ran entirely on the operator’s infrastructure, no vendor monitoring or account revocation was possible, unlike incidents involving hosted models. The only remaining safeguard was a hardcoded blocklist that prevented commands capable of destroying the agent’s own host.
The operator’s activity became visible only because the server exposed its /hermes-results/ directory with listing enabled. Threat intelligence researchers recovered 585 files and roughly 470 MB of tooling, including custom Go implants and exploit scripts for older vulnerabilities in polkit, sudo, and IIS. No evidence was found that data left the ministry network. Thailand’s national CERT and cybersecurity agency were notified on 15 July, though no public statement had appeared by 24 July.
Why it matters
Directly addresses security risks of autonomous AI agents for security professionals, including actionable warnings on YOLO mode and default service exposures that Dutch teams can apply to their AI deployments and monitoring.
