Hermes AI Agent Runs Unattended Against Thai Finance Ministry

Something shifted in how we should think about AI-assisted intrusion this week, and it did not look like the usual jailbreak headline. According to reporting from The Hacker News, an operator pointed Nous Research's open-source Hermes agent at Thailand's Ministry of Finance and switched on YOLO mode, a documented feature the project itself flags as trusted-sandbox-only that strips out the human approval step. The agent then did the repetitive part on its own: run a scan, read the output, decide what to check next. As the report puts it, nobody had to approve each one.

What researchers actually saw came from the operator's own sloppiness. Threat intelligence firm Hunt.io and researcher Bob Diachenko found an exposed staging server holding 585 files and 470 MB of attack tooling, including the agent's logs. Those logs show it running standard LinPEAS-style privilege escalation checks, then reaching a Hadoop cluster with default credentials via HiveServer2, the SQL front end to that cluster, on an internal machine at port 10000. From there the logs record the agent walking into a folder of office documents, performance evaluations, and personnel records dating to 2012 under the Office of the Permanent Secretary. Crucially, the same logs do not show those files leaving the network.

The attribution is worth reading carefully because Hunt.io hedges it. The staging server's Hong Kong IP previously hosted ShadowPad and VShell command-and-control infrastructure, and the Hermes web interface password contained the Chinese word Leishen, for thunder god. On that basis, Hunt.io says only that it has low-to-medium confidence the operator is Chinese-speaking or fluent in the language. A previously undocumented Go implant called Hades sat on the server in 62 variants, but the report is explicit that no recovered artifact shows Hades reaching a ministry machine.

The honest caveat is that most of what makes this different is not the AI. Default Hadoop credentials, an internally exposed HiveServer2, and an operator who left a staging directory publicly listable are all pre-AI problems. What the reporting does not give you is a ministry confirmation, an exfiltration timeline, or an identity beyond the low-confidence language cue.

The part worth watching is the operating model. Because Hermes runs on the operator's own machine, there is no vendor watching and no account to ban, which is where past AI-abuse stories were quietly disrupted upstream. Defenders who benefit here are the ones who treat unattended agent traffic as its own signature and who close the boring misconfigurations that turned this from an experiment into an incident.