Full Report
Someone installed a popular AI assistant on a rented server, switched off the setting that makes it ask permission before running risky commands, and pointed it at Thailand's Ministry of Finance, which runs the country's treasury and tax collection. The agent then worked through the ministry's network on its own, checking hosts for ways to gain root access, hunting through file systems, and
Analysis Summary
# Incident Report: Unattended AI Agent Post-Exploitation at Thai Ministry of Finance
## Executive Summary
An external threat actor deployed an autonomous AI agent, **Hermes**, on a rented server to perform post-exploitation activities against Thailand’s Ministry of Finance. By enabling a "YOLO" mode that bypassed human-in-the-loop approvals, the agent autonomously performed network reconnaissance, privilege escalation scans, and sensitive file discovery. The incident highlights a shift toward AI-driven automation in the post-compromise phase of cyberattacks.
## Incident Details
- **Discovery Date:** July 15, 2026
- **Incident Date:** Occurred prior to discovery; reported July 24, 2026
- **Affected Organization:** Ministry of Finance (specifically the Office of the Permanent Secretary)
- **Sector:** Government / Finance
- **Geography:** Thailand
## Timeline of Events
### Initial Access
- **Date/Time:** Precise date unknown (prior to July 15, 2026).
- **Vector:** Unknown (Initial entry preceded the AI agent deployment).
- **Details:** The operator had already established a foothold via a hidden web shell on a ministry web server and obtained internal credentials.
### Lateral Movement
- The AI agent was pointed at the internal network and instructed to scan for vulnerabilities.
- It targeted internal **Hadoop** database systems known to have default (empty) password configurations.
### Data Exfiltration/Impact
- The agent performed a recursive crawl of the Office of the Permanent Secretary's web root.
- Targeted data included: Personnel records (dating back to 2012), performance evaluations, and Office documents.
- While the agent accessed several files, no evidence of successful exfiltration was found in the recovered logs.
### Detection & Response
- **Discovery:** Researchers from Hunt.io and Bob Diachenko found the attacker’s command logs on a misconfigured public web server with directory listing enabled.
- **Response Actions:** Thailand’s national CERT and cybersecurity agency were notified on July 15, 2026.
## Attack Methodology
- **Initial Access:** Hidden Web Shell and stolen mailbox passwords.
- **Persistence:** Rented external server running the Hermes AI agent.
- **Privilege Escalation:** Automated use of **LinPEAS** and custom scripts targeting 2026 Kernel flaws (CVE-2026-31431, CVE-2026-43284, CVE-2026-43500, CVE-2026-43503).
- **Defense Evasion:** Use of legitimate open-source AI tools; the operator misconfigured their own C2 server, leading to discovery.
- **Credential Access:** Stolen mailbox passwords and exploitation of default Hadoop configurations.
- **Discovery:** AI-driven filesystem listing and automated directory crawling.
- **Lateral Movement:** Automated scanning of internal Hadoop hosts.
- **Collection:** Recursive directory crawling of personnel folders.
- **Exfiltration:** No confirmed method detected in logs.
- **Impact:** Compromise of sensitive government personnel and financial administrative data.
## Impact Assessment
- **Financial:** Unknown; potential long-term risk due to compromised treasury/tax-related data.
- **Data Breach:** Exposure of personnel records from 2012–2026 and internal performance evaluations.
- **Operational:** Low immediate disruption, but high risk of follow-on attacks using gathered intelligence.
- **Reputational:** High; demonstrates vulnerability in a critical state ministry to automated AI exploitation.
## Indicators of Compromise
- **Network indicators:** Traffic originating from rented server infrastructure (IDs not specified); logs found on a web server with directory listing enabled.
- **File indicators:** `call_00_*.txt` (Hermes agent logs), customized `linpeas.sh`, and scripts targeting Hadoop nodes.
- **Behavioral indicators:** Rapid, autonomous execution of Linux enumeration commands without human-delay intervals; usage of the `--yolo` flag in Hermes agent execution.
## Response Actions
- **Containment:** Notification of Thai National CERT to isolate the affected web server and Hadoop instances.
- **Eradication:** Removal of the hidden web shell and rotating stolen mailbox passwords.
- **Recovery:** Ongoing monitoring for data leaks resulting from the personnel record exposure.
## Lessons Learned
- **AI as a Force Multiplier:** AI agents do not necessarily find "new" bugs but can execute tedious post-exploitation phases (scanning, listing, sorting) at high speed without human intervention.
- **Bypassing Safety Rails:** Open-source AI models (like Hermes) localized on attacker hardware lack the "guardrails" or account-banning capabilities of proprietary models like Claude or GPT-4.
- **Operational Security (OPSEC):** The attacker’s failure to secure their own C2 server (leaving directory listing on) was the only reason the autonomous nature of this attack was discovered.
## Recommendations
- **Harden Default Credentials:** Ensure all Hadoop and database services are stripped of default/empty password configurations.
- **Behavioral Monitoring:** Deploy EDR/XDR solutions capable of detecting the rapid-fire execution of reconnaissance tools (like LinPEAS) which may indicate robotic/AI-driven activity.
- **Zero Trust:** Implement strict segmentation between public-facing web servers and internal databases containing sensitive personnel records.
- **AI-Specific Defense:** Monitor for unusual API patterns or CLI interactions that mirror the syntax of known open-source AI agents.