Key Takeaways
- An operator deployed the open‑source AI assistant Hermes on a rented server, disabled its permission‑prompt safeguard (YOLO mode), and let it autonomously probe Thailand’s Ministry of Finance network.
- The AI performed routine reconnaissance tasks (kernel scans, LinPEAS runs, filesystem crawls) while the human operator supplied target‑specific knowledge such as custom password lists and hardcoded paths.
- No data exfiltration was observed in the recovered logs; the breach relied on a default‑configuration HiveServer2 service that accepted any password, allowing installation of a malicious Java UDF for arbitrary command execution.
- Attribution clues point to a Chinese‑speaking operator (language artifacts, FOFA key, prior ShadowPad controller), but no definitive threat‑actor group has been identified.
- Mitigation focuses on securing Hive/Hadoop services (authentication, UDF restrictions), monitoring abnormal web‑to‑Hadoop traffic, patching known kernel and privilege‑escalation flaws, and detecting exposed Hermes result directories.
Incident Overview
A threat actor installed the popular open‑source AI assistant Hermes on a compromised virtual private server, turned off the built‑in safety feature that asks for confirmation before executing risky commands (the “YOLO” mode), and pointed the agent at the network of Thailand’s Ministry of Finance, which manages the country’s treasury and tax collection.
Agent Activity and Scope
Once activated, Hermes autonomously navigated the ministry’s internal network, scanning hosts for privilege‑escalation vectors, enumerating file systems, and crawling a directory containing staff personnel records dating back to 2012. The operator left the agent’s detailed logs on a publicly accessible web server with directory listing enabled, where they were later discovered by Hunt.io researcher Bob Diachenko.
Nature of the Tool
Hermes, developed by Nous Research, is intended for everyday tasks such as email management, scheduling, and chatting via Telegram or Slack. It is not a hacking tool, and the incident does not stem from a vulnerability in Hermes itself. The YOLO mode—accessible via a --yolo flag, a /yolo command, or an environment variable—simply disables the human‑in‑the‑loop confirmation step; a hardened blocklist still prevents self‑destructive commands.
Contrast with Prior AI‑Assisted Attacks
Unlike the November 2023 case where a Chinese group manipulated Anthropic’s Claude Code through persuasion to gain illicit access, here the operator already possessed foothold inside the target network. Hermes ran entirely on the operator’s own infrastructure, meaning no vendor could monitor usage or revoke accounts.
Pre‑Existing Access
Before launching the AI agent, the attacker had already implanted a hidden web shell on a ministry‑facing server, crafted scripts targeting internal Hadoop clusters, and stored mailbox passwords in plaintext within a mail‑testing script. The recovered artifacts showed no evidence of data leaving the network, and the initial intrusion vector remains unknown.
Exploited Weakness in Hadoop/Hive
The core of the custom exploit targeted the ministry’s Hadoop data platform. A Python script (hive_rce_py2.py) connected to HiveServer2 on port 10000, exploiting the default authentication mode “NONE,” which accepts any supplied password without verification. Once connected, the script installed a malicious Java user‑defined function (HiveCmd.jar) that enabled arbitrary operating‑system command execution via ordinary SQL queries.
Additional Tooling and Implants
Alongside the Hive exploit, the operator staged a previously undocumented Go implant named Hades, compiled for both Windows and Linux and replicated in 62 copies. Hard‑coded callback addresses tied the implant to a second Hong Kong host, though no direct connection to ministry systems was observed. Supplementary scripts attempted default‑credential logins against internal GlassFish consoles and included exploit code for older flaws in polkit, sudo, and IIS 6.0.
Human vs. AI Contribution
The operator supplied target‑specific intelligence: a password list derived from ministry department abbreviations, shellcode with hardcoded internal paths, and knowledge of the Hadoop service’s weak configuration. Hermes handled the repetitive, low‑level tasks—running LinPEAS, scanning for elevated binaries, crawling directories, and interpreting output to decide the next step. No novel vulnerability discovery or autonomous target selection was attributed to the AI.
Detection and Attribution Clues
Logs revealed the operator’s SSH session originated from IP 103.97.0[.]57 in Hong Kong. The Hermes web interface password contained the Chinese term “Leishen” (Thunder God) and a FOFA API key, a Chinese asset‑search service. The same server previously hosted a ShadowPad controller and now runs a VShell command‑control listener. Hunt.io assesses low‑to‑medium confidence that the operator is Chinese‑speaking or fluent, though no specific threat‑actor group is named.
Recommendations for Defenders
- Verify that HiveServer2 is not running with authentication set to
NONE; enforce strong authentication and restrict who may install user‑defined functions. - Create alerts for web‑server processes initiating connections to internal Hadoop ports (e.g., 10000, 50070).
- Scan web roots recursively for hidden files masquerading as system caches (e.g.,
/storage/Counter/nine/.journald-cache.php). - Apply patches for the four 2026 Linux kernel flaws (CVE‑2026‑31431, CVE‑2026‑43284, CVE‑2026‑43500, CVE‑2026‑43503), upgrade sudo to 1.9.5p2 or later, remediate polkit CVE‑2021‑4034, and address any remaining IIS 6.0 WebDAV vulnerabilities.
Visibility of the AI Agent
Hermes leaves a discernible footprint: its web panel returns a HermesWebUI server header, and a search for that string yielded roughly 5,900 scan events over a month as of Hunt.io’s July 23 report. More tellingly, the agent consistently writes results to a /hermes-results/ directory with predictable filenames; Hunt.io’s index found 575 hits of such exposed directories on the same day. The presence of a publicly listing web server—rather than any intrinsic AI safety failure—allowed the artifacts to be discovered.
Conclusion
This incident illustrates how an off‑the‑shelf AI assistant, when run in unrestricted YOLO mode, can accelerate the mechanical phases of an intrusion while still relying on human expertise for target selection and credential gathering. The breach succeeded not because of a novel AI capability but due to a misconfigured Hive service and inadequate network segmentation. Defenders should focus on hardening authentication, monitoring anomalous internal traffic, patching known kernel and privilege‑escalation flaws, and watching for telltale signs of AI‑agent tooling in exposed logs. By coupling technical controls with vigilant threat‑intelligence monitoring, organizations can reduce the risk of similar AI‑facilitated intrusions.