Hermes AI agent used for unattended post-exploitation at Thailand finance ministry

Intelligence Summary

An attacker reportedly deployed the Hermes AI assistant on a rented server for autonomous post-exploitation. The setup disabled permission prompts for potentially risky commands, allowing unattended execution. The agent was then directed at Thailand’s Ministry of Finance systems involved in treasury and tax operations. It allegedly performed internal reconnaissance and attempted to identify paths to root access. Organizations should assume AI-enabled tooling can accelerate compromise and tighten controls around remote command execution and admin access.

Recommended Action

Prioritize immediate review, validate exposure, and patch or mitigate affected systems.

Topics