Hackers Used an Autonomous AI Agent to Attack Thailand’s Finance Ministry

• The Mess: Attackers used the open-source Hermes AI agent in unattended “YOLO” mode during an apparent cyber-espionage campaign targeting Thailand’s Ministry of Finance. Exposed attacker infrastructure contained exploit code, web shells, stolen credentials, malware and AI-agent logs showing automated post-compromise activity.

There is one important correction to our earlier list:

This isn’t a brand-new incident from August 27. The underlying activity was uncovered in July, although it is still being reported and discussed by security organizations today. ThaiCERT published an alert on August 27 specifically warning about the broader use of AI-assisted attacks against Internet-facing Windows and Linux servers.

And the Thailand case is interesting enough to deserve its own post.

The attackers weren’t simply using an LLM to write a few scripts.

They apparently gave an AI agent permission to execute commands without human approval.

Hermes was running in “YOLO mode,” allowing it to perform potentially dangerous operations autonomously. Researchers found logs showing the agent exploring systems, gathering information, searching files and looking for ways to escalate privileges.

That’s a very different threat model.

Human says:

“Find a way into this network.”

AI agent starts working.

It can inspect the environment.

Run commands.

Analyze results.

Try another approach.

Repeat.

No coffee break required.

• The Damage: The attackers reportedly obtained access to multiple systems and exposed credentials, authentication cookies, web shells and malware, creating the conditions for persistent espionage and further compromise.

The exposed attacker server was almost as interesting as the attack itself.

Researchers found around 585 files totaling roughly 470 MB, including exploit code, web shells, tunneling tools, scripts, credentials and Hermes logs. Some files referenced internal Ministry of Finance systems, hostnames and IP addresses.

The tooling targeted several technologies, including:

• Hadoop infrastructure
• Apache Ambari
• GlassFish
• administrative web panels
• mail infrastructure

Researchers also identified a previously undocumented malware family called Hades.

But there’s an important caveat.

The Ministry of Finance has not independently confirmed that its systems were compromised, and researchers noted that some recovered artifacts demonstrate targeting rather than successful exploitation.

So this isn’t a case where we should blindly write:

“AI hacked the Thai government.”

The evidence supports something more precise.

Attackers used an autonomous AI agent as part of an intrusion operation, and researchers found evidence suggesting successful access to multiple systems.

That’s already bad enough.

• The Fix: Treat AI agents with the same suspicion as any other privileged automation: restrict command execution, isolate them from production networks, protect credentials and monitor every action they perform.

The bigger lesson isn’t specific to Thailand.

AI agents are increasingly capable of interacting with real systems.

Give an agent access to a shell and it can execute commands.

Give it credentials and it can authenticate.

Give it network access and it can explore.

Remove the human approval step and you have something much closer to an automated operator.

That’s useful when you’re building software.

It’s considerably less amusing when the operator is on the wrong side.

For defenders, that means monitoring behavior, not just malware signatures.

Unexpected shell commands.

New web shells.

Authentication from unusual locations.

Abnormal internal scanning.

Credential use outside normal working patterns.

Sudden privilege escalation.

And especially automation that starts behaving like an attacker.

ThaiCERT’s August 27 warning about UAT-10147 makes the same point from another angle: attackers are already using AI to accelerate reconnaissance, vulnerability analysis, exploit development and post-compromise activity against exposed Windows and Linux servers.

Bugstoday Opinion

This is where the AI security discussion gets uncomfortable.

The scary part isn’t that an AI can write malware.

Humans have been writing malware for decades.

The scary part is giving the AI enough access to operate the malware itself.

Once an agent can observe the result of its own actions, adjust its strategy and continue without asking permission, the economics of an attack change.

One attacker can potentially supervise more operations.

More targets.

More attempts.

More persistence.

Less manual work.

Bugstoday verdict: don’t worry about AI becoming a super-hacker tomorrow. Worry about someone giving today’s AI a shell, credentials and “YOLO mode.” That’s already enough to make a bad day considerably worse.