An intruder inside Thailand's Ministry of Finance handed the repetitive half of the job to a machine. Threat intelligence firm Hunt.io and researcher Bob Diachenko recovered the evidence after the operator left the agent's own logs on a web server with directory listing enabled: 585 files and roughly 470 MB of attack tooling, including the agent's step by step record of working through the ministry network without a human approving each command. The ministry runs Thailand's treasury and tax collection. Thailand's national CERT and cybersecurity agency were notified on July 15, and neither had published anything as of July 24.
What Happened
The operator rented a server, installed Hermes, an open source AI assistant from Nous Research, and disabled the setting that makes it ask permission before running risky commands. Hermes exposes that mode, called YOLO, as a documented command line flag with three separate ways to enable it. The operator then pointed the agent at the ministry's internal network and walked away.
The agent worked the network on its own: checking hosts for privilege escalation paths, hunting through file systems, and crawling a directory of staff personnel records dating back to 2012. It ran a scan, read the output, decided what to check next, and ran another. None of the commands were exotic. LinPEAS, the standard Linux privilege escalation enumeration script. A search for files carrying elevated permissions. A directory crawl. A human operator would have typed the same things. The only thing that changed is that nobody had to approve any of them.
Critically, the human was already inside before the agent started. Hunt.io recovered a hidden web shell planted on a ministry web server, scripts written against named internal Hadoop systems, and stolen mailbox credentials hardcoded into a mail testing script. Nothing in the recovered material shows the agent discovering a new vulnerability or selecting the target. The human did every part that required knowing the victim.
What Was Taken
There is no evidence in the recovered files that data left the network. That is a meaningful limit on this incident and should be stated plainly rather than assumed away.
What the agent demonstrably reached is still serious. It crawled a folder of ministry staff personnel records going back to 2012, meaning fourteen years of employee data in a government finance body was accessible to an unsupervised process. The operator held working mailbox passwords for ministry accounts, hardcoded into a testing script, which implies prior credential theft that predates the agent entirely. The web shell gave persistent hands on access to a ministry web server.
The absence of proven exfiltration in a 470 MB dump of leftover tooling is not the same as the absence of exfiltration. The recovered material is what one careless operator forgot to take down.
Why It Matters
Every AI assisted intrusion reported so far had a vendor in the loop. When Anthropic disclosed a Chinese espionage group abusing Claude Code last November, the attackers had to manipulate the model into cooperating, and Anthropic banned the accounts once it detected the activity. That detection and that ban were only possible because the model ran on someone else's infrastructure.
Hermes runs on the operator's own machine. There is no vendor watching, no usage telemetry, no account to suspend, and no safety layer to jailbreak. The operator did not defeat a guardrail. They used a flag.
This collapses the enforcement model that most AI security policy currently assumes. Detection has to move to the network and the endpoint, because the model layer is no longer a chokepoint anyone controls. The practical defensive read is that agent driven post exploitation looks exactly like human post exploitation, only faster and more consistent, and the tooling it uses is the tooling defenders have been detecting for a decade. Nothing about this case requires a new detection category. It requires that the existing ones actually fire.
The Attack Technique
How the operator first got into the ministry is unknown. The recovered files start after initial access was already established.
The pivot that matters for other organizations is Hadoop. The operator's scripts were built to exploit a Hadoop database service that ships accepting any password by default, a configuration that turns an exposed cluster in a fiscal systems environment into a free credential bypass. The scripts targeted named internal Hadoop hosts, which means the operator had already mapped the environment.
The human tradecraft in the dump is unmistakably targeted. Hunt.io's writeup describes a password list built from the ministry's own department abbreviations rather than a generic dictionary, and shellcode carrying hardcoded paths into the ministry intranet. Then the agent took over for enumeration, privilege escalation checks, and file discovery. The division of labor is the story: humans for target knowledge, agents for volume.
What Organizations Should Do
- Audit every Hadoop, HBase, and related big data service for default authentication. Any service that accepts arbitrary passwords out of the box should be treated as unauthenticated and firewalled accordingly, especially in finance and government environments.
- Alert on LinPEAS, setuid and setgid enumeration sweeps, and rapid recursive directory crawls. These are the exact commands the agent ran, they are well documented, and an agent runs them faster and more completely than a human would. Volume and cadence are your signal.
- Hunt for web shells on internet facing servers now, and check for directory listing enabled on your own hosts. This operator was found because they left listings open. Assume your adversary will be more careful, and assume you will not get that gift.
- Rotate mailbox credentials and enforce phishing resistant MFA. Hardcoded stolen passwords in the operator's tooling indicate credential theft that preceded the agent and would survive its removal.
- Treat unattended AI agents as an insider threat category in your egress and endpoint policy. Locally run agents produce no vendor side telemetry, so the only place you will see them is your own network. Baseline what normal automated activity looks like on your hosts.
- Segment internal analytics and data platform clusters from general corporate networks. The Hadoop pivot worked because the cluster was reachable from wherever the operator's foothold was.
Sources: Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry - Cybernoz