Overview
A threat actor used the open-source Hermes AI agent — a productivity automation tool from Nous Research — in fully autonomous "YOLO" mode to conduct post-exploitation activity during an alleged breach of Thailand's Ministry of Finance. The operation represents a notable real-world case of a legitimate AI productivity tool being repurposed for offensive security operations with zero custom malware development.
The attack was discovered not through defensive telemetry, but because the attacker left their own operation logs exposed on a web server with directory listing enabled. Researchers at Hunt.io and independent researcher Bob Diachenko found the logs alongside 585 files and approximately 470 MB of attack tooling, effectively self-documenting the entire post-exploitation campaign.
What Is YOLO Mode
Hermes is an open-source AI agent framework from Nous Research, typically used for productivity automation tasks. It supports three methods of enabling its unattended "YOLO" mode — which disables human confirmation checkpoints and allows the agent to act autonomously:
| Method | Syntax |
|---|---|
| CLI flag at launch | hermes --yolo |
| In-session command | /yolo |
| Environment variable | HERMES_YOLO_MODE=1 |
The Hermes documentation explicitly warns that YOLO mode should only be used in "trusted, sandboxed environments." The one hard safeguard that remains active even in YOLO mode is a blocklist preventing the agent from wiping its own host machine.
By toggling a single flag, the attacker converted a productivity tool into an autonomous cyber operator.
What the Agent Did
Five activity log files — named call_00_*.txt — documented the agent's autonomous actions against Ministry of Finance infrastructure:
1. Kernel Vulnerability Scanning
The agent ran a customized linpeas.sh script modified to check for four 2026 Linux kernel CVEs against a ministry host, probing for known privilege escalation paths.
2. Second LinPEAS Enumeration Pass
A second LinPEAS run performed broader system enumeration — users, sudo rules, cron jobs, network interfaces, and installed packages.
3. Privilege Escalation Scanning
The agent scanned for SUID and GUID binaries — a standard technique for finding local privilege escalation vectors on Linux systems.
4. Full Filesystem Listing
A recursive listing of the entire filesystem was executed, providing the attacker with a complete map of the target environment.
5. Web Root Crawl
The agent performed a recursive crawl of the web root belonging to the Office of the Permanent Secretary, Thailand's senior civil service body within the Finance Ministry. The crawl revealed:
- Office documents accessible from the web root
- Staff performance evaluations
- Personnel records dating back to 2012
The logs confirmed directory reads but did not provide definitive evidence of bulk exfiltration.
How Researchers Found It
The threat actor made a critical operational security error: after deploying the attack tooling on a rented server, they left the agent's own log files exposed on that same server with Apache/nginx directory listing enabled.
When Hunt.io's passive scanning infrastructure discovered the open directory, researchers found:
- 5 operation log files (
call_00_*.txt) documenting every agent action - 585 total files on the server
- ~470 MB of attack tooling and supporting scripts
This gave researchers a near-complete picture of the attack playbook — without ever needing to analyze a compromised victim system.
Why This Matters
This incident is significant for several reasons:
No Custom Malware Required
The attacker used an off-the-shelf open-source AI tool with its human-approval flag disabled. The only "customization" was modifying linpeas.sh to target specific 2026 CVEs. The barrier to autonomous AI-assisted attacks has dropped dramatically.
Fully Autonomous Post-Exploitation
Once YOLO mode was activated, the Hermes agent executed an entire post-exploitation workflow — kernel scanning, enumeration, privilege escalation probing, and document discovery — without a human in the loop. This demonstrates that AI agents can serve as fully autonomous post-exploitation operators, not just assistants.
The Dual-Use AI Problem in Practice
Security researchers have long warned that AI productivity tools could be weaponized with minimal modification. This incident is one of the first documented real-world cases confirming that warning against a government target.
Opsec Failures Create Attribution Opportunities
The attacker's failure to secure their own infrastructure gave defenders more intelligence about the attack than they would have obtained from victim-side forensics alone. Automated exposure monitoring (like Hunt.io's passive scanning) is increasingly relevant as attackers adopt AI tooling that generates verbose logs.
Indicators of Concern
Organizations using Hermes or similar AI agent frameworks should:
- Audit YOLO mode usage — ensure it cannot be enabled in production or shared environments
- Log all agent actions — agentic frameworks should have mandatory audit trails regardless of mode
- Network-segment AI agents — agents operating in elevated privilege contexts should not have unrestricted network access
- Monitor for linpeas.sh execution — even modified variants produce recognizable filesystem access patterns
References
- BleepingComputer: Hermes AI Agent Used to Automate Attack on Thai Finance Ministry
- The Hacker News: Hacker Runs Hermes AI Agent Unattended for Post-Exploitation
- Hunt.io Threat Intelligence
- Nous Research — Hermes Project