Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry

A Thai Ministry of Finance employee installed the Hermes AI assistant, a tool designed for mail management and task automation, on a rented server. The agent, left running unattended, autonomously scanned the ministry’s network, exploited outdated vulnerabilities, and accessed sensitive data, including personnel records dating back to 2012 and a Hadoop database cluster. The operator, suspected to be Chinese-speaking, exploited a default authentication setting in HiveServer2 to gain access to the cluster and install a malicious Java add-on. The incident highlights the risks of unattended AI tools and the importance of securing default configurations and network access.

What happened

The employee installed Hermes, a tool not designed for hacking, but which can be used to manage mail and run chores over Telegram or Slack. The operator used a YOLO mode, a documented feature that allows running commands without explicit permission, which is what separated this case from other AI-assisted attacks. The operator was already inside the network before the agent started, having planted a hidden web shell on a ministry web server and staging scripts for a Hadoop database service.

Technical details

• **Affected Products/Vendors:** Hermes (Nous Research), Apache Hadoop, HiveServer2, Cloudera
• **CVEs:** CVE-2026-31431, CVE-2026-43284, CVE-2026-43500, CVE-2026-43503, CVE-2021-4034
• **Attack Vector:** Exploitation of default authentication settings in HiveServer2, exploitation of outdated Linux kernels, exploitation of polkit and sudo vulnerabilities.
• **Exploitation Status:** Exploited
• **CVSS Score:** Not available
• **Malware:** Hades (Go implant)
• **Threat Actors:** Suspected Chinese-speaking operator (no group identified)
• **Countries:** Thailand, Hong Kong
• **Sectors:** Government, Finance

Impact

The operator gained access to a vast amount of sensitive data, including personnel records dating back to 2012, and exploited a Hadoop database cluster. The incident demonstrates the potential for attackers to leverage readily available tools and default configurations to compromise sensitive systems. The lack of oversight and the use of a tool not designed for hacking allowed the operator to conduct a prolonged reconnaissance and exploitation campaign.

What to do

• Check whether HiveServer2 is running with authentication set to NONE, and restrict who can install user-defined functions.
• Alert when a web server process opens a connection to internal Hadoop ports such as 10000 or 50070.
• Search web roots recursively for PHP files with leading-dot names that imitate system caches.
• Patch kernels against all four 2026 flaws above, plus sudo to 1.9.5p2 or later, polkit for CVE-2021-4034, and any remaining IIS 6.0 WebDAV.

The agent leaves its own trail. Hermes’s web panel returns a HermesWebUI server header, and a search on that string returned roughly 5,900 scan events over a month, as of Hunt.io’s July 23 report, counting sightings rather than distinct machines. The better hook is where the agent writes its results: a consistent /hermes-results/ folder with predictable filenames, which turned up 575 hits in Hunt.io’s index of exposed directories the same day, each one a host and filename pair. No safety control exposed this operator. A directory listing did.