# An Open-Source AI Agent Just Ran Point on a Government Espionage Op
Nobody approved the commands. Nobody watched the terminal. The AI just ran.
That's the detail that deserves to stick from Hunt.io's disclosure last week about a cyberattack against Thailand's Ministry of Finance: the threat actor didn't just use AI as a planning tool or a code generator. They handed autonomous operational control to an open-source agent called Hermes, set it to "YOLO mode" — a literal configuration that bypasses human approval gates — and let it work.
This is different. Not in degree, but in kind.
## What YOLO Mode Actually Means
Hermes is not some sophisticated nation-state implant. It's a publicly available autonomous AI agent. YOLO mode is its unrestricted execution setting — the one that removes the checkpoints where a human operator would normally confirm each action before the agent proceeds. The attacker flipped the switch and stepped back.
From July 9 to 13, Hunt.io's Attack Capture platform detected three simultaneous open directories hosted in Hong Kong. Inside: exploit code targeting multiple CVEs, web shells for persistent access, suo5 HTTP tunnels for covert channel communication, and custom scripts. The presence of suo5 is notable — it's a high-performance HTTP/HTTPS tunneling tool that proxies traffic through legitimate web protocols, making detection significantly harder for network defenders watching for unusual outbound connections.
Hunt.io couldn't pin down the exact initial access vector. What they could see was the post-exploitation infrastructure, and it was extensive. The attacker had apparently done the hard work of getting in, then handed subsequent operations to Hermes to conduct reconnaissance, lateral movement, or whatever objectives were set.
The Thai government acknowledged the report on July 15 — the same day Hunt.io and researcher Bob Diachenko notified Thailand's national CERT and National Cyber Security Agency. Publication followed after the standard seven-day disclosure window. Officially, the MOF has said nothing.
## The Playbook Is Being Written in Real Time
Here's the context that matters: this is the second documented case of autonomous AI agents running offensive cyber operations in a single month.
Earlier in July, incident response firm Sygnia detailed how a lone attacker used AI to orchestrate a sophisticated campaign against a large AWS environment — complex enough to ultimately result in successful extortion. One person, one AI, one enterprise cloud customer. The attacker scaled their capabilities beyond what any single human operator could realistically manage manually.
Thailand follows the same template. The open directories Hunt.io found suggest the attacker wasn't particularly worried about operational security on their infrastructure side — a possible sign they were moving fast, or that they expected the MOF wouldn't detect the compromise quickly enough to pivot on the exposed staging servers.
Speed is the point. Human attackers have to sleep. They make typos under pressure. They hesitate before running a particularly noisy command. An agent in YOLO mode has none of those constraints. It executes, logs, pivots, and continues — at machine pace, without second-guessing.
## The Open-Source Problem Nobody Wants to Say Out Loud
The Hermes agent isn't a leaked intelligence community tool. It didn't require a supply chain compromise or insider access to acquire. It's open source.
That changes the threat model for every organization that has been quietly assuming sophisticated AI-assisted attacks require sophisticated attackers. They don't. The capability gap between a nation-state threat group and a motivated independent actor just shrank — again.
What made the Thai MOF attack operationally significant wasn't novel zero-days or an advanced implant family. It was the automation of post-exploitation tradecraft. The parts of an intrusion that require sustained human attention — maintaining persistence, tunneling traffic, executing scripts across compromised systems — are exactly the parts that autonomous agents are well-positioned to handle.
## What Defenders Are Now Up Against
The defensive community has been discussing AI-assisted offense for two years. The conversations have been mostly theoretical. They shouldn't be anymore.
A few specific things this incident should change for security teams:
Detection timelines shrink. If an agent is executing post-exploitation steps without human approval cycles, the window between initial compromise and full objective completion compresses. Organizations running 24-hour mean-time-to-detect cycles are now racing against something that doesn't sleep.
Behavioral baselines matter more. You may not catch the initial access. But an autonomous agent conducting reconnaissance and lateral movement will generate behavioral signals — unusual authentication patterns, abnormal internal scanning, HTTP tunnels that look like legitimate web traffic but aren't. Suo5-style tunneling, specifically, should be on detection backlogs for any SOC that hasn't already added it.
Open directories are an intelligence gift. The attacker's sloppiness in leaving infrastructure exposed is what gave Hunt.io visibility into this operation. Threat hunting that includes monitoring for exposed staging infrastructure — not just inbound threats — would have flagged this earlier.
Government ministries aren't the only targets. Espionage operations against finance ministries are a feature, not a bug, of state-level intelligence collection. But the tooling here — open-source, autonomous, cheap — makes the same attack pattern viable against corporate treasury departments, financial regulators, and any organization that holds data of strategic value.
## HackWire Analysis
Two AI-autonomous offensive operations in one month is not a trend line yet. But it's a credible signal.
The specific concern isn't that AI makes attackers smarter. It's that it makes them more persistent and more scalable at lower cost. A human pentester running post-exploitation manually on a government network is expensive, slow, and risky. An agent in YOLO mode running the same steps is none of those things.
What's missing from most coverage of this incident is attention to the open-source nature of the tooling. Hermes isn't classified. It isn't specialized. The barrier to reproducing this attack isn't technical sophistication — it's willingness.
That means the organizations most at risk aren't just high-value targets of nation-states with elite cyber units. They're any organization that a motivated, moderately capable attacker decides is worth three days of effort and a cloud bill. Government ministries, critical infrastructure operators, regional financial institutions — all of them now need to assume that the resource asymmetry they've implicitly counted on (attackers have to work hard; defenders just have to detect) has shifted.
The Sygnia AWS case last month involved one person successfully extorting a large enterprise. The Thai MOF case this month involved an autonomous agent conducting espionage against a national government. Neither required a team.
Detection engineering teams should be adding suo5 tunneling signatures now. Incident response playbooks should account for accelerated post-exploitation timelines. And threat intelligence programs that haven't started tracking open-source offensive AI agent tooling need to start immediately — because YOLO mode doesn't wait for the quarterly review.
— HackWire Editorial
---
## Related Coverage