585 files totalling about 470 MB were uncovered on a Hong Kong server, and they all point to the same unsettling use of the Hermes AI agent. The files, discovered between July 9 and July 13, include exploit code, web shells, stolen credentials, and logs that show the agent running in unattended “YOLO” mode to automate post‑exploitation activity against Thailand’s Ministry of Finance. That’s the most concrete evidence we have so far, and it raises serious questions about how open‑source AI tools can be weaponized.
Historical Context
The emergence of open‑source AI assistants dates back to the early 2020s, when developers began publishing large language models that anyone could download and run locally. By 2024, a handful of projects started embedding system‑level capabilities, letting the model execute shell commands or interact with APIs. Those early experiments sparked debate about the line between convenience and risk. Security researchers warned that if a model could be instructed to run arbitrary code, attackers might find a new shortcut to scale complex attacks.
Hermes entered the scene in February 2026, positioning itself as a “persistent” assistant. Its claim to remember context across sessions set it apart from stateless chatbots that reset after each query. The repository emphasized a “YOLO” toggle—a flag that disables the usual human‑in‑the‑loop confirmations. The developers explicitly said the setting should live only in sandboxed environments. That disclaimer now feels like a pre‑mortem note, given the recent findings.
Key Takeaways
- Hunt.io found 585 files (~470 MB) linked to a Hermes‑driven intrusion.
- The AI agent was set to YOLO mode, bypassing human approval for dangerous commands.
- Logs detail privilege‑escalation scans, container inspection, and bulk document enumeration.
- Shared TLS certificates connect the Hong Kong server to hosts in Malaysia and Hong Kong.
- The Ministry of Finance hasn’t confirmed a breach, and some artifacts only show targeting, not successful compromise.
Hermes AI Agent in YOLO Mode: What the Leak Shows
Hermes, released in February 2026, is marketed as a persistent AI assistant that can remember context across sessions. The tool can interact with system utilities, run commands, and even drive custom scripts. What’s shocking is that the attacker flipped the so‑called YOLO setting, which strips out any prompts that would otherwise require a human to approve risky actions. That means the agent could launch commands, scan for vulnerabilities, and collect data without waiting for a thumbs‑up.
Background on Hermes
According to the open‑source repo, Hermes runs as a background service and stores state between tasks. It can be fed objectives, then it reaches out to configured tools to fulfill them. The developers warned that YOLO mode should only be used in controlled environments, because it effectively hands the reins over to the AI. In this case, the threat actor used it exactly as warned against—letting an autonomous script run unchecked across a target network.
Technical Architecture of Hermes and Its YOLO Mode
At its core, Hermes consists of three interacting components: a daemon that maintains persistent state, a command dispatcher that translates objectives into system calls, and a plug‑in framework that lets users add custom scripts. The daemon watches a local directory for new “objective” files, then parses them and hands them off to the dispatcher. When YOLO mode is disabled, the dispatcher pauses before each potentially destructive call, prompting the operator for confirmation. Enabling YOLO removes that pause, turning the dispatcher into a fully automated executor.
Because the daemon runs with the privileges of the launching user, the impact of a compromised instance depends on where it is deployed. If an attacker gains access to a service account with elevated rights, the AI can mirror those rights without additional escalation. The plug‑in system also allows the model to call external binaries—LinPEAS, Docker, or any custom scanner—making it a flexible reconnaissance engine.
From a defensive standpoint, each component leaves a trace. The daemon writes logs to a predictable location. The dispatcher creates temporary files that mirror the commands it runs. Plug‑ins often spawn child processes that inherit the daemon’s environment. Detecting anomalies in any of those layers can reveal an unsanctioned AI run, even when the human operator is absent.
Attack Infrastructure: From Hong Kong to Malaysia
Three directories were exposed on a Hong Kong host, each brimming with the attacker’s tooling. Hunt.io traced the same TLS certificates across other IPs, noting a shared JA4X fingerprint. “In addition to the common name, all these certificates share a JA4X fingerprint, a hash derived from the structure of the certificate itself rather than its contents,” explained Hunt’s report. The fingerprint linked the Hong Kong server to a Malaysian address (118.107.222[.]232) and another Hong Kong host (202.181.27[.]115). Those machines later showed up in a command‑and‑control address embedded in a recovered implant, suggesting a coordinated infrastructure.
Shared TLS Certificates Reveal Links
Because the certificates were identical in structure, the researchers could query the hash in HuntSQL and pull up the two related hosts. One of those hosts was later tied to the operation via a hard‑coded C2 URL inside the Go‑based implant the attackers called Hades. That implant, built for both Windows and Linux, hadn’t been seen before, which adds another layer of novelty to the campaign.
Post‑Exploitation Automation: Logs Detail the Tasks
The most compelling part of the dump was the Hermes output logs. Five separate call logs show the agent executing a series of tasks that any seasoned pentester would consider routine—but the fact that an AI performed them autonomously is what makes this noteworthy. The tasks included searching for kernel vulnerabilities, enumerating services, locating SUID/SGID binaries, inspecting Docker containers, and traversing file systems.
Privilege‑Escalation and Enumeration
One log shows Hermes invoking a customized version of the LinPEAS script to gather privilege‑escalation data from a Ministry host. Another call instructed the agent to recursively scan a directory tied to the Office of Permanent Secretary for Finance, cataloguing PDFs, DOCs, and XLS files that dated back to 2012. The researchers didn’t find evidence of exfiltration, but the mere fact that the files were identified and listed shows the agent was gathering intelligence at scale.
Response From Thai Authorities and Uncertainty
Both ThaiCERT and the National Cyber Security Agency were notified on July 15, and they acknowledged receipt of the alert. However, the Ministry of Finance hasn’t publicly confirmed that its systems were breached. Hunt.io stresses that while session files, deployed web shells, and internal IP references prove the attackers had footholds, they couldn’t verify whether those footholds translated into full system compromise.
Ministry of Finance and ThaiCERT Statements
When BleepingComputer reached out for comment, the Ministry said it hadn’t confirmed any breach, and ThaiCERT offered no additional details beyond confirming they had been alerted. That leaves a gray area: the evidence points to an active intrusion, yet the official line remains non‑committal. For developers and security teams, that ambiguity is a reminder that attribution and impact assessment can be murky.
Implications for Developers and Security Teams
Automation of post‑exploitation steps isn’t new—scripts and frameworks have done it for years. What’s different now is an open‑source AI agent that can run unattended, making it easier for less‑skilled actors to execute complex chains without constant supervision. If you build tools that expose APIs or command interfaces, you might unintentionally give an AI a playground to roam.
What This Means For You
First, audit any internal services that accept remote commands. Even if you think a tool is only for legitimate admin use, an attacker could repurpose it with an AI like Hermes to automate reconnaissance and privilege‑escalation. Second, consider disabling or tightly controlling any “YOLO”‑style settings in your own automation pipelines. Those flags are designed for lab environments, not production networks.
Finally, keep an eye on open‑source AI projects that intersect with security tooling. The line between helpful assistant and malicious weapon can blur quickly when a developer forgets to lock down the ability to execute arbitrary system calls. Staying aware of how these tools are being misused will help you harden defenses before an incident surfaces.
Concrete Scenarios for Teams
Scenario 1: A DevOps team uses a chat‑enabled bot to trigger Kubernetes rollouts. If the bot runs with cluster‑admin rights and YOLO is enabled, an adversary could ask the bot to list all secrets, then dump them to an external server. The team would see only a normal rollout command, not the hidden data‑exfiltration.
Scenario 2: An internal ticketing system lets staff run diagnostics via a web hook. An attacker who gains access to the webhook can feed the AI a series of diagnostic objectives. With YOLO, the AI could silently enumerate user accounts, locate privileged scripts, and plant a persistent backdoor.
Scenario 3: A third‑party SaaS provider offers a “smart assistant” that can query databases on demand. If the assistant’s underlying model can invoke shell commands, a compromised API key could be used to run a YOLO‑enabled instance that harvests data across multiple tenant databases.
Each of these examples shows how a seemingly innocuous feature becomes a vector when AI is given the freedom to act without oversight.
Key Questions Remaining
- Will open‑source communities introduce mandatory safety checks for AI agents that can execute system commands?
- How can defenders detect autonomous AI activity that mimics legitimate automation?
- What governance models will emerge to balance rapid AI innovation with the need for secure deployment?
Will future threat actors lean more heavily on autonomous AI agents, or will defenders develop counter‑AI measures to detect and neutralize them? That’s the question we should be asking as we watch the next wave of AI‑driven cyber operations.
Sources: BleepingComputer, original report
