# The Hacker Who Let an AI Run Loose Inside Thailand's Treasury
Someone rented a server, installed an AI assistant, disabled the part where it asks permission before doing something risky, and pointed it at the Thai Ministry of Finance. Then they walked away.
That's not a hypothetical. That's what happened — probably sometime before July 15, 2026, when Thailand's national CERT received its notification. The hacker left their own logs sitting on a publicly accessible web server with directory listing enabled, which is how Hunt.io and researcher Bob Diachenko found 585 files and 470 megabytes of attack tooling, including turn-by-turn transcripts of what the agent actually did inside the ministry's network.
The tool is Hermes, an open-source AI assistant from Nous Research built for managing email, running automations, and taking instructions over Telegram or Slack. Nobody should call it malware. The feature the operator used — YOLO mode — is documented, has its own command-line flag (--yolo), and the project's own configuration guide says to "only use this in trusted, sandboxed environments." The hacker trusted it in a Ministry of Finance.
## What YOLO Mode Actually Removes
This is the part worth understanding before the broader panic sets in.
Standard Hermes operation requires human confirmation before the agent executes potentially dangerous commands. YOLO mode removes that gate. The operator can flip it three ways: --yolo at launch, /yolo mid-session, or setting HERMES_YOLO_MODE=1 as an environment variable. One safeguard does survive it: a hardcoded blocklist that refuses commands that would wipe the machine the agent runs on. Everything else proceeds on the agent's own judgment.
What the agent actually did was methodical and unspectacular. Five transcript files — named call_00_*.txt — log five sessions: kernel vulnerability scanning against a ministry host, a second LinPEAS run, a sweep for binaries with elevated permissions, a filesystem listing, and a recursive crawl of the web root belonging to the Office of the Permanent Secretary, which held Office documents, performance evaluations, and personnel records stretching back to 2012. The logs show the agent reading that directory. They do not show files leaving.
LinPEAS is a standard privilege escalation discovery script. A search for SUID binaries, a filesystem crawl — these are things a junior pentester learns on day two. The agent wasn't doing anything exotic. It was doing repetitive, methodical reconnaissance without anyone having to approve each step.
That last sentence is what matters.
## This Is Not the Anthropic Case
When Anthropic disclosed last November that a Chinese threat group had been using Claude Code for espionage, the situation was fundamentally different. Those attackers had to manipulate a vendor-hosted model into cooperating, and Anthropic was able to identify the accounts and ban them.
Hermes runs on the operator's own hardware. There are no accounts to ban. No vendor is watching the inference. No safety team can intervene. The operator had already established access before the agent started — a web shell on a ministry web server, scripts written against named internal Hadoop systems, stolen mailbox passwords hardcoded into a mail-testing script all predate the agent's activity in the recovered material.
The human did what required knowing the target. Hunt.io's writeup describes a custom password list built from the ministry's own departmental abbreviations rather than a generic dictionary. The shellcode carried hardcoded paths into the ministry intranet. Someone had done the recon, built the wordlist, understood the environment.
The agent handled the repetitive execution layer. Run a scan, read the output, decide what to probe next, run another. Nobody approved each one.
## The Hadoop Problem Hidden in the Logs
The attack scripts were built around a specific vulnerability: a Hadoop database service configured to accept any password by default. Hadoop's older configurations — particularly when deployed without proper security settings — can ship open to anonymous connections or use default credentials that nobody changed during deployment.
This is less a zero-day story and more a misconfiguration story with an AI wrapper. Government IT in many countries runs infrastructure that's years behind on hardening. Thailand's Ministry of Finance runs treasury and tax collection for the country. The internal Hadoop systems referenced in the scripts likely handle data at a scale that makes a browseable personnel folder from 2014 look minor by comparison.
The customized LinPEAS scan checked for four 2026 Linux kernel vulnerabilities across three families, suggesting the operator was current on recent exploitation paths. Whether those scans yielded privilege escalation isn't visible in the recovered material.
## The Operational Security Irony
The attacker ran a fairly disciplined operation inside the ministry's network, then left their entire toolkit — logs, scripts, tooling — on a web server with directory listing enabled.
Hunt.io found it. Bob Diachenko found it. Any threat intelligence team with good passive scanning infrastructure found it. The ministry's defenders might have found it too, had they been looking at outbound or lateral connections from the compromised web server.
Thailand's CERT and national cybersecurity agency were notified July 15. Neither had released a public statement nine days later. That silence isn't unusual for government CERTs managing an active incident, but it means defenders in adjacent sectors — regional finance ministries, tax agencies, government Hadoop deployments — are flying blind about what specifics the attackers used.
## HackWire Analysis
The industry has been running the same argument loop for two years: AI will supercharge attackers, AI is just another tool, defenders can use it too, etc. This incident cuts through the argument by being specific.
What changed here isn't capability — LinPEAS and directory crawls aren't new. What changed is the economics of persistence. Post-exploitation is tedious. You land on a machine, you run your enumeration scripts, you read the output, you decide what to try next, and you do it again across a dozen hosts. It requires attention. A human operator inside a network has to be awake, has to be present, has to make each decision. The dwell time between gaining initial access and completing reconnaissance is partly a function of how many hours an attacker can stay focused.
YOLO mode doesn't make the agent smarter. It makes the agent tireless.
The prior model for agentic AI attacks assumed a vendor in the loop — something to constrain, something to trick, something that could notice and intervene. Hermes on a rented server has none of that. As more capable local models become available and easier to self-host, the assumption that vendor-side guardrails will catch this class of attack becomes operationally false.
For defenders, the immediate concrete action isn't "audit your AI exposure" — it's the basics the attack scripts targeted: Hadoop configurations accepting any password, default credentials in legacy systems, SUID binaries that shouldn't be there, Linux kernels behind on 2026 patch cycles. The agent only found what was already there to find.
The more uncomfortable question is what a better-resourced operator does with this approach against a target that doesn't leave their logs on a public web server. This case is visible because the operator made a rookie mistake. The ones we won't see are the ones where they didn't.
— HackWire Editorial
---