technologyneutral
Hacker Lets AI Agent Roam Thailand’s Finance Ministry Without Human Oversight
ThailandFriday, July 24, 2026
A hacker rented a server and deployed the open‑source assistant Hermes from Nous Research, turning off its safety prompt. The AI was pointed at Thailand’s Ministry of Finance (MoF), where it autonomously traversed the network, hunting for privilege‑escalation vectors and delving into a folder containing staff records dating back to 2012.
How the Attack Worked
| Step | Action |
|---|---|
| 1 | Setup – The attacker rented a server, installed Hermes, and disabled the “YOLO” safety flag. |
| 2 | Initial Access – A hidden web shell and scripts were already planted inside the MoF, targeting its Hadoop infrastructure. |
| 3 | AI Scan – With no human approval required, Hermes executed a series of automated commands: |
| • Scanning for kernel vulnerabilities. | |
| • Running the LinPEAS privilege‑escalation script. | |
| • Searching for files with elevated permissions. | |
| • Crawling directories across the intranet. | |
| 4 | Data Harvest – The AI traversed a folder holding employee records and collected 585 files, totaling nearly half a gigabyte of malicious tools. |
| 5 | Exfiltration – Logs and collected data were left on a public web server that allowed directory browsing, making them discoverable by security researchers. |
Key Details
- Hermes is designed for routine tasks (mail handling, task automation via Telegram or Slack).
- The YOLO mode disables the safety prompt that normally requires user confirmation for command execution.
- The attacker had prior access to the ministry’s network, having planted a web shell that targeted Hadoop’s default‑authenticated HiveServer2.
- The custom scripts leveraged a password list derived from ministry department names and included shellcode pointing to hard‑coded intranet paths.
- No evidence indicates that data left the ministry’s network; how initial access was achieved remains unknown.
Takeaways for Defenders
- Disable Default Authentication – Ensure Hadoop’s HiveServer2 does not accept any password by default.
- Monitor Web Servers – Watch for connections from internal Hadoop ports and look for hidden PHP files that mimic system caches.
- Patch Vulnerabilities – Regularly update kernel and related software to close known exploits.
- Restrict AI Use – Keep AI assistants like Hermes in sandboxed environments and enable YOLO mode only when absolutely necessary.
- Check for Hidden Files – Search for unexpected files in critical directories that could be used to exfiltrate data or log activity.
The Thai national CERT was notified on July 15, but no public statement had been released at the time of reporting. The incident underscores how disabling AI safety features can transform a benign tool into an autonomous threat actor.
Actions
flag content
