Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged

Source: Hunt.io — 2026-07-23

Summary

Researchers at Hunt.io, working with independent security researcher Bob Diachenko, found three publicly exposed staging directories on a Hong Kong-hosted server between July 9-13, 2026, containing 585 files (roughly 470MB) of attack tooling, stolen credentials, and — notably — logs from Nous Research's open-source Hermes AI agent running unattended in "YOLO mode" against Thailand's Ministry of Finance network. The same exposed infrastructure revealed a previously undocumented custom implant the operator named "Hades."

Key Takeaways

• Hermes, an open-source autonomous agent released in February 2026 that runs as a persistent, memory-retaining service, was pointed at the ministry's network in YOLO mode — a setting that auto-approves potentially dangerous commands without human review.
• Recovered logs show the agent independently running LinPEAS-style privilege-escalation enumeration, then reaching a Hadoop cluster via HiveServer2 using default credentials.
• From there the agent walked into a folder of office documents, performance evaluations, and personnel records dating back to 2012, exfiltrating them autonomously, with no evidence a human operator manually directed each individual step.
• The exposed server also hosted 62 payloads across Windows and Linux, including builds of a previously unreported Go-based implant dubbed "Hades," capable of interactive remote shell access, persistence, in-memory execution, file transfer, and SOCKS proxying — though no recovered artifact shows Hades actually reaching a ministry machine.
• Total recovered material: 585 files, roughly 470MB, spanning exploit code, web shells, HTTP tunneling tools, custom scripts, stolen credentials, compiled payloads, and the Hermes agent's own logs.
• This is a rare concrete, forensic look at an autonomous AI agent performing real post-exploitation and data theft with minimal human oversight, rather than a hypothetical or lab demonstration.

Reel Script

Hook An attacker pointed an open-source AI agent at a government finance ministry, walked away, and let it run unattended. It scanned for privilege escalation, found a database with default admin credentials, and stole personnel files going back to 2012 — on its own.

Core Concept Hermes is a real open-source autonomous AI agent from Nous Research, built to run as a persistent service that remembers context across sessions. Most agent frameworks have a safety setting that pauses before running risky commands and waits for human approval. Attackers disabled that here, running Hermes in what's called "YOLO mode," where the agent auto-approves its own dangerous actions instead of asking permission. Researchers at Hunt.io, working with Bob Diachenko, found the evidence sitting in the open: three exposed staging directories on a Hong Kong server, leaking the attacker's own tooling and logs alongside the stolen data.

Hands-On The attack chain reconstructed from the leaked logs runs in four steps. First, reconnaissance: the agent ran LinPEAS-style privilege-escalation checks automatically, the same enumeration technique human pentesters use to find misconfigurations. Second, lateral discovery: it located a Hadoop cluster reachable through HiveServer2, still running with default, never-rotated credentials. Third, data access: it walked directly into a folder of office documents, performance evaluations, and personnel records dating to 2012, no obfuscation needed because the door was already open. Fourth, exfiltration: it pulled the data out, all logged automatically as part of the agent's normal operation. Separately, the same exposed server hosted a custom Go implant called Hades, built for both Windows and Linux, with remote shell, persistence, and SOCKS proxying, staged but with no confirmed evidence it reached a ministry machine. In total, investigators recovered 585 files and about 470MB of attacker tooling and logs. Note: this reconstruction comes from logs and files an attacker inadvertently left exposed, as documented by Hunt.io researchers, not a controlled test.

Takeaway This isn't a proof-of-concept anymore, it's a forensic record of an unattended AI agent performing real privilege escalation and real data theft against a government network, with a novel implant staged for the next stage. Any team running agent frameworks with auto-approve or "YOLO" modes on production or unattended infrastructure should treat that setting as a live liability, not a convenience — audit it today.

Discussion

(No questions yet — ask follow-ups via a Claude Code chat session on this repo; answers get appended here.)