Hermes AI Agent in YOLO Mode: Thai Finance Ministry

What happened with Hermes and the Thai Ministry of Finance?

According to The Hacker News (July 24, 2026), the agent's logs were found by the company Hunt.io and researcher Bob Diachenko on a web server with directory listing enabled. The exposed material included 585 files and 470 MB of attack tooling. Hunt.io's report is dated July 23; Thailand's national CERT and cybersecurity agency were notified on July 15, and neither had published anything as of July 24. The article contains no statement from the ministry.

Hermes is an open source assistant from Nous Research used to manage email, run chores and take instructions over Telegram or Slack. The article specifies that it is not a hacking tool and that the case reveals no flaw in the software.

What is YOLO mode?

It is a documented Hermes feature that skips the human approval step before risky commands. It is enabled with the --yolo flag, the /yolo command mid-session or the environment variable HERMES_YOLO_MODE=1. The project's guide asks to use it "only in trusted, sandboxed environments". A hardline blocklist still blocks commands that would wipe the host.

What did the agent actually do?

According to the logs, the agent ran kernel vulnerability scans against a ministry host, a second LinPEAS run, a search for elevated-permission binaries, a filesystem listing and a recursive crawl of the web root of the Office of the Permanent Secretary. That folder held documents, performance evaluations and personnel records dating to 2012. The logs show the directory was read; none shows files leaving the network.

The human role remains central: the operator was already inside before the agent started, and the initial access method is unknown. The operator built the password lists, scripts and exploit code. The agent handled the repetitive scan-and-decide work, without being shown to find new vulnerabilities or choose the target. The scripts targeted HiveServer2 on port 10000, whose default authentication mode is NONE, and the operator had staged a Go implant named Hades and a VShell command-and-control listener. Hunt.io assesses with low-to-medium confidence that the operator is Chinese-speaking, naming no group.

What does this change in the threat model?

General-purpose agents become practical offensive tooling, with no vulnerability to fix. Three evolutions are worth absorbing.

• Pace: an unattended agent chains scans faster and longer than a lone operator.
• Barrier to entry: the operator did not write a post-exploitation framework; they installed an assistant and cut the confirmation. Repetitive analysis work shifts to the machine.
• Logging: an agent records what it does. That helps defenders when they capture it, and it is also what gave the operator away here.

The case does not demonstrate an end-to-end autonomous intrusion: the human supplied the access, the tools and the target. It shows an agent as an accelerator for an attacker already in place.

What should defenders do?

1. Detect machine tempo: fast probing, repetitive filesystem crawls, sustained credential attempts across several hosts. Add them as a detection category.
2. Reduce weak services: a data analytics service exposed with authentication disabled, like HiveServer2 in NONE mode, is exactly what the scripts looked for. Check your default configurations.
3. Segment the network: a compromised host must not be able to browse staff shares or internal web roots freely.
4. Monitor your public exposure: web servers with directory listing, open object storage. Scan yourself regularly.
5. Prepare incident response for this kind of trace: structured agent logs, command history, repeated reasoning patterns.

Which traces of an autonomous agent should you look for in your logs?

An agent leaves signatures different from those of a human operator. Here are the ones you can look for today, on servers and workstations that have telemetry.

• Cadence: series of enumeration commands separated by a few seconds, without a human's pauses, including at night and on weekends.
• Privilege escalation audit tools run several times at close intervals (LinPEAS is cited in the case) and searches for elevated-permission binaries.
• Recursive crawls of web roots or shares, with sequential reading of many files.
• Regular outbound connections to messaging services (Telegram, Slack) from servers with no legitimate use for them.
• Environment variables or options specific to agents, such as those that disable confirmations, in shell histories or process command lines.
• Data services exposed without authentication inside the internal network, which serve as easy targets.

These signals complement each other: none proves agent use on its own, but their combination justifies an investigation. Document them in an incident response guide so that the on-call person knows what to look for.

Two further habits help. First, keep process command lines and shell history for at least a few months on critical servers, because agent options often show up there. Second, test your own detections by running a harmless agent in a lab and checking which of these signals your tools actually see; the gaps you find are the ones an attacker would use.

What if your own teams use autonomous agents?

Frame the use of modes without confirmation. Disabling approvals must be a privileged, logged action, limited to isolated environments, with short-lived credentials and no access to production systems. See the AI agent security page and the article on function calling.

How do you test detection of a no-confirmation agent on your network?

In a test perimeter and with authorization, run an agent on a test workstation with harmless enumeration commands (folder listings, reading dummy files, authentication requests on a test account) at fast cadence. Measure whether your detection tools raise an alert, how fast, and whether the logs let you reconstruct the sequence. CleanIssue's Agent Red Team Express (EUR 1,900, 5 days) tests the agents you deploy, their rights and their outputs: see the offer. The first contact is a free 30-minute discovery call to decide which system rights an autonomous agent should keep in production.

Further reading

• sandbox escape forensics
• an agent that escapes its sandbox
• autonomous AI attack on Microsoft IKE