Hermes attack shows the risk of unattended AI agents

What this is about

Security firm Hunt.io reported on July 23, 2026, an attack against systems of Thailand's Ministry of Finance in which an open Hermes AI agent ran unattended. According to Hunt.io, an exposed server held 585 files totaling roughly 470 MB: exploit code, web shells, credentials, scripts, tunneling tools, and the agent's own logs.

The point is not that Hermes was built as malware. The point is that a normal agent with approval prompts disabled can act as an accelerator for post-exploitation in the wrong context. That makes the case relevant for companies, administrators, and developers.

What the attack actually does

According to Hunt.io's findings, the agent ran in so-called YOLO mode. In that mode, an agent executes commands without asking for individual human approval. The logs reportedly show the agent enumerating hosts, traversing file systems, processing LinPEAS output, and handling signs of internal systems. Hunt.io also names a previously unreported Go implant called Hades.

BleepingComputer and The Hacker News both stress that Thai authorities had not confirmed the incident at the time of reporting. Some artifacts document targeting and activity, while others point to compromised systems. That uncertainty matters: the case is not a clean legal proof, but it is strong evidence of how attackers are already using agents in practice.

Why it matters

Many agent tools are designed to read local files, execute shell commands, call web services, use passwords from vaults, and accept tasks through chat channels. That is powerful for legitimate work. It is also powerful for attackers.

The Hermes case exposes a new operational question: not only the model must be safe, but the runtime environment. When an agent combines broad permissions, stored credentials, and unattended execution, it creates an attack chain that traditional security teams can easily underestimate. This is especially relevant for firms running internal agents on developer machines, servers, or support systems.

In plain language

Imagine giving an intern a master key, a task list, and the instruction never to ask before opening a door. If everything is planned correctly, the work moves quickly. If the task list is manipulated or the intern is in the wrong building, speed becomes damage.

YOLO mode is exactly that missing control point. It removes friction, but also removes the moment when a human notices: the agent should not be doing this.

A practical example

A company runs an internal agent for DevOps tasks. It can read logs, start deployments, comment on tickets, and run diagnostic commands on test servers. In normal mode, it asks before risky steps. In unattended mode, it is meant to complete 40 routine checks overnight.

A compromised ticket, however, contains an indirect instruction to read environment variables and send them to an external endpoint. If the agent runs without approval and has access to production keys, a small text manipulation can become a real security incident. Even if only 2 of 40 checks are critical, those two steps can be enough for data theft or lateral movement.

Scope and limits

First, the specific Thailand incident has not been fully confirmed publicly. A serious assessment must distinguish between observed artifacts, researcher interpretation, and confirmed damage.

Second, Hermes is not automatically unsafe simply because it was abused. The risk comes from configuration, permissions, network access, and lack of supervision. The same pattern can affect other agent platforms.

Third, agent detection does not replace basic hardening. Network segmentation, short-lived secrets, least privilege, EDR, logging, and clear approval rules remain necessary. An agent does not make weak security architecture harmless; it makes it faster.

SEO & GEO keywords

Hermes Agent, YOLO mode, AI agents, AI Security, post-exploitation, Hunt.io, Thailand Ministry of Finance, agent security, prompt injection, least privilege, credentials, Hades implant