What Happened
A threat actor breached Thailand’s Ministry of Finance and deployed the open-source Hermes AI agent in unattended mode to automate post-exploitation activity. Threat intelligence firm Hunt.io and researcher Bob Diachenko uncovered the operation after the attacker left an exposed web directory containing 585 files totalling roughly 470 MB — including exploit code, web shells, HTTP tunneling tools, stolen credentials, compiled payloads, and Hermes agent call logs.
The recovered logs document five Hermes sessions. In each, the agent performed kernel vulnerability scanning, LinPEAS enumeration, sweeps for SUID and SGID binaries, container inspection, filesystem traversal, and a recursive crawl of the web root belonging to the Office of the Permanent Secretary. That directory held Office documents, performance evaluations, and personnel records dating to 2012.
Hermes is an open-source AI agent released in February 2026. It runs as a persistent service with memory between sessions and executes tool calls and OS commands autonomously. The attacker ran it with approval prompts disabled — referred to as YOLO mode — then left. The agent conducted reconnaissance and lateral exploration without an operator present. No formal attribution to a known threat actor has been made, according to reporting by BleepingComputer and The Hacker News.
Why This Matters for Canadian Organizations
This incident is one of the first documented cases of an open-source AI agent conducting hands-off post-exploitation at a government target. The barrier to replicating this tradecraft is low — Hermes is public, free, and designed for general task automation. Any attacker who achieves initial access to a network now has a ready-made tool to carry out reconnaissance, privilege escalation searches, and data discovery without remaining interactively present on the target system.
Canadian federal and provincial government departments, Crown corporations, municipalities, financial institutions, and any organization holding sensitive HR, financial, or operational records face the same exposure. An attacker who plants an AI agent and walks away generates the same intelligence as a skilled human operator — but with fewer interactive traces and no requirement to maintain a persistent session that detection tools might flag.
Security operations centres that rely on detecting interactive attacker behaviour — unusual login timing, command typing cadence, known attacker tool signatures — may miss AI agent-driven activity, which resembles automated tooling rather than human operators. Under OSFI B-13 and PIPEDA’s accountability principle, organizations are expected to detect and contain unauthorized access promptly. AI agent-assisted intrusions compress the time between initial compromise and significant data exposure, shrinking detection windows.
The CCCS and its Five Eyes partners have warned of increasing AI enablement in threat actor operations. This incident provides concrete evidence of what AI-assisted post-exploitation looks like in practice and should inform the threat models Canadian security teams apply to government and critical infrastructure networks.
What to Do
Review EDR and SIEM detection rules for process chains consistent with automated enumeration: LinPEAS, PEASS-ng, and similar binaries executing in rapid succession from unexpected parent processes. Build detection logic for open-source AI agent runtimes — including Hermes and similar Python-based agentic frameworks — on endpoints where they serve no legitimate business purpose. Enforce least-privilege access on internal file servers so a single compromised account cannot recursively traverse sensitive HR or operational directories. Alert on large-scale automated directory traversal events. Update incident response playbooks to account for AI agent-assisted post-exploitation, where traditional indicators of human-operated intrusion — interactive shell timing, sequential manual commands — may not apply.
