Hermes AI agent used to automate attack on Thai Finance Ministry

Threat actors leveraged the open-source Hermes AI agent to autonomously execute post-exploitation commands against Thailand's Ministry of Finance, targeting unpatched or misconfigured services including Hadoop, Apache Ambari, and mail servers. The 'YOLO' mode operation — where the AI executed commands without human approval — represents a dangerous escalation in attack automation, reducing the time defenders have to detect and respond. Critically, attack artifacts such as web shells, exploit code, and logs were left in exposed directories, indicating both poor configuration hygiene and inadequate monitoring of internet-facing systems. This incident underscores that AI-assisted attacks can dramatically compress the exploitation lifecycle, making proactive vulnerability management and real-time monitoring non-negotiable for critical government infrastructure.