Hermes AI Agent Attacks Thai Finance Ministry: Unattended Exploits

An AI agent was used to autonomously navigate the network of Thailand's Ministry of Finance. Someone installed the Hermes AI assistant on a rented server and configured it to run risky commands without permission. This agent then worked through the ministry's network, searching for ways to gain root access, exploring file systems, and crawling personnel records. The operator left the agent's logs on a web server, where they were discovered by a threat intelligence firm. These logs revealed 585 files and 470 MB of attack tools. Hermes itself is not a hacking tool; the operator used a documented feature called YOLO mode, which allows the agent to operate without constant human oversight. The operator was already inside the network before the AI agent began its work, having planted a web shell and stolen mailbox passwords. This incident highlights how AI can automate repetitive tasks in a cyberattack once an initial breach occurs.