The record
Written from the 2 reports below. Nothing here is unsourced.
- A hacker installed a Hermes AI agent on a rented server, enabled its unattended 'YOLO' mode, and used it to automate post-exploitation tasks inside Thailand's Ministry of Finance, including privilege-escalation scans and crawling a folder of staff personnel records dating back to 2012.
- The agent's own logs were left exposed on a web server, where threat intelligence firm Hunt.io and researcher Bob Diachenko discovered them, along with hundreds of files of attack tooling.
- Hermes is a legitimate open-source assistant, and this case differs from earlier AI-assisted attacks because the software ran on the operator's own machine with no vendor oversight and no account to ban.
- The human operator had already breached the ministry and did the target-specific work, while the agent performed repetitive scanning and triage without needing approval for each command.
What to watch next
- Whether Thailand's national CERT or cybersecurity agency publishes findings after being notified on July 15
- Hunt.io's low-to-medium confidence assessment of a Chinese-speaking operator and whether any group is later attributed
- Whether organizations patch or secure default-unauthenticated Hadoop HiveServer2 configurations highlighted in the report
What changed2
Every report on this story, newest first. Times are when each outlet published.
Why it matters4
Who is affected first and what likely follows, with a direction and a horizon. Extracted from the reports, never invented.
- Thailand Ministry of Finance post exploitation reconnaissance· immediate
- Linux kernel users (4.14–5.10.254) privilege escalation risk· days
- Red Hat Enterprise Linux 8.x deployments patch required· days
- Web server infrastructure unauthorized internal network scanning· immediate
Coverage2
2 reports
English national1International1
Filed from United States ×5, India ×1
Named Thailand · Hong Kong SAR China · Apache · Apache Ambari · Cloudera · GlassFish · Hadoop · HiveServer2 · Linux · Ministry of Finance · Polkit Project · Redhat · Thailand Ministry of Finance
The 2 reports are listed beside the record.
Ask this story
Answers cite the reports above, or say they can't.