Hermes AI Agent Run Unattended for Post-Exploitation Inside Thailand's Ministry of Finance

Thailand's Ministry of Finance, which manages the national treasury and tax collection

An operator stood up Hermes, an open-source AI assistant from Nous Research built for mail management and task automation over Telegram or Slack, on a rented server and pointed it at the ministry's internal network with human approval switched off. The agent enumerated systems on its own, ran LinPEAS privilege-escalation scans targeting four 2026 Linux kernel vulnerabilities, reached the Office of the Permanent Secretary's directory holding staff files and performance evaluations dating to 2012, and abused default authentication on an Apache HiveServer2 instance to install malicious Java user-defined functions for command execution. Recovered logs showed file access but no confirmed exfiltration. Documented by Hunt.io and researcher Bob Diachenko, who published on July 15, 2026, with wider coverage on July 24

The operator launched Hermes with its documented "YOLO" command-line flag, a supported option that removes the human approval step before command execution, converting a collaborative assistant into an unsupervised intrusion platform. The initial network access method is still unknown