Attack automation is becoming accessible
BleepingComputer reported on July 24 that a threat actor used the open-source Hermes AI agent in unattended “YOLO” mode to automate post-exploitation activity during an alleged intrusion involving Thailand’s Ministry of Finance. The report is based on exposed attacker directories analyzed by Hunt.io and security researcher Bob Diachenko.
The ministry had not confirmed a breach when the article was published, and researchers cautioned that some artifacts demonstrate targeting rather than successful compromise. That uncertainty matters. The responsible takeaway is not that an AI agent independently attacked a government. It is that an operator appears to have supplied objectives and tools while unattended execution accelerated routine work after access was obtained.
What happened
Researchers found three exposed directories containing 585 files and about 470 MB of material, including exploit code, web shells, tunneling tools, scripts, credentials, payloads, and agent logs. The artifacts referenced ministry hosts and internal addresses. Hunt.io reported evidence consistent with access to multiple systems, but the initial entry method and full impact were not established publicly.
Five recovered agent call logs reportedly showed Hermes being used to enumerate services, inspect containers and file systems, search for privileged binaries, scan for kernel vulnerabilities, and look for privilege-escalation paths. In another task, it catalogued documents in a web directory. Hunt.io said it found no evidence that those documents were exfiltrated.
The unattended setting removed prompts that otherwise require a person to approve dangerous commands. According to the report, this let the operator’s agent continue analyzing systems and executing routine post-exploitation commands without stopping for confirmation.
Why it matters for growing businesses
Cybercrime economics matter to SMEs. Attackers do not need an agent to invent a novel strategy if automation helps them scan faster, adapt commands, summarize results, and repeat techniques across more targets. Weakly protected companies can face more persistent and individualized activity without the attacker adding equivalent human effort.
The same design question exists inside the business. Helpful agents may execute shell commands, update cloud settings, browse internal documents, or connect to ERP and email. Unattended mode is not inherently malicious, but it removes a safety checkpoint. It should be limited to low-risk, reversible actions inside a tightly constrained environment.
Traditional controls remain valuable. Multi-factor authentication, patching, endpoint monitoring, segmentation, backups, and least privilege reduce the footholds and pathways that an automated operator can exploit. Good logs also let defenders distinguish scanning from successful access and respond based on evidence.
Prepare for faster attacker tempo
An automated operator may move from discovery to credential testing and file enumeration in minutes. Response plans designed around a next-day review are too slow for critical alerts. Assign an on-call decision path for disabling an account, isolating a host, blocking an address, and preserving logs. Pre-authorize those containment actions so a small team does not wait for a management meeting during an incident. Centralize timestamps from identity, endpoint, firewall, cloud, and application logs; without synchronized evidence, it becomes much harder to determine what the attacker merely attempted and what actually succeeded.
Practical action checklist
- Enforce phishing-resistant MFA for administrators, remote access, email, cloud, and ERP accounts.
- Remove internet exposure from management consoles and require a controlled VPN or zero-trust gateway.
- Patch operating systems, edge devices, web applications, container platforms, and identity services promptly.
- Separate user networks, servers, backups, and administrative interfaces to limit lateral movement.
- Eliminate shared administrator credentials and rotate secrets after staff or supplier changes.
- Alert on web shells, tunneling tools, unusual child processes, privilege changes, and rapid file enumeration.
- Restrict internal agents to dedicated identities, approved tools, hard action limits, and reviewed logs.
- Require confirmation for destructive commands, credential access, external uploads, and security-control changes.
- Maintain offline or immutable backups and rehearse restoring a critical ERP or file service.
- Preserve evidence and contact the appropriate incident-response and national cyber authorities quickly.
How VDS Consultoria can help
VDS Consultoria helps SMEs reduce practical attack paths around Odoo, cloud services, integrations, and automation. We can review exposure and access, separate service identities, strengthen approval rules, improve backup and monitoring procedures, and build an incident checklist appropriate to the organization’s size.
AI changes the speed and scale of both business automation and hostile activity. The response is not to abandon agents. It is to ensure that no agent—internal or attacker-controlled—can turn one weak credential or unpatched service into unrestricted movement across the company.
Source
BleepingComputer, “Hermes AI agent used to automate attack on Thai Finance Ministry,” July 24, 2026: https://www.bleepingcomputer.com/news/security/hermes-ai-agent-used-to-automate-attack-on-thai-finance-ministry/