Hermes AI Agent Used to Automate Attack on Thai Finance Ministry

An attacker repurposed the open-source Hermes AI agent by enabling its unattended "YOLO" mode to autonomously perform post-exploitation activity against Thailand's Ministry of Finance, including kernel CVE scanning, LinPEAS enumeration, SUID/GUID probing, full filesystem listings, and a webroot crawl that exposed office documents and personnel records; researchers discovered the campaign after the attacker left detailed operation logs and ~470 MB of tooling exposed on a publicly-accessible server, yielding a near-complete playbook of the attack.