Security researchers say an intruder inside Thailand's Ministry of Finance network handed the routine part of the job to an AI agent, and let it run without asking permission for each command.
The research, published on 23 July by Hunt.io with security researcher Bob Diachenko, is one of the more concrete accounts yet of an autonomous agent being used in a live intrusion. It is also more limited than the headline suggests, and the limits are in the researchers' own words.
What the agent actually did
The tool is Hermes, an open-source AI agent released in February 2026 that runs as a persistent daemon and keeps memory across sessions. It supports a mode that removes the prompts asking a human to approve potentially dangerous commands, and the recovered logs show the operator ran it that way.
| # | What the agent did, per the recovered logs |
|---|---|
| 1 | Privilege-escalation assessment and kernel vulnerability scanning on a ministry host |
| 2 | A second scanner run, adding service enumeration |
| 3 | Enumerating SUID and SGID binaries |
| 4 | Listing containers and filesystems |
| 5 | Recursively crawling a web root holding personnel records dating to 2012 |
Five logs, recovered from the operator's own exposed directories. Reconnaissance and discovery — no exploitation decisions, no lateral movement choices, no objective-setting.
Five call logs were recovered. All five show reconnaissance on a host the operator could already reach: scanning for privilege-escalation paths, enumerating services and SUID binaries, listing containers and filesystems, and crawling a web directory holding personnel records dating to 2012.
The agent's documented involvement ends there. It made no exploitation decisions, chose no targets and set no objectives.
The division of labour
| Phase | Who did it | Evidence |
|---|---|---|
| Initial access | Unknown | Researchers state twice that the method was not evident |
| Post-exploitation reconnaissance | The AI agent, unattended | Five recovered call logs |
| Exploitation chain for the ministry's stack | Human operator | Scripts written against this specific target |
| Credential lists built from department abbreviations | Human operator | Ministry-specific naming in the scripts |
| Custom scanner supplied to the agent | Human operator | A modified LinPEAS "provided to the Hermes agent" |
| Tasking the agent | Human operator | "the operator instructed the agent to enumerate a content directory" |
The distinction that matters. The agent ran without per-command approval, but every documented action is reconnaissance after access already existed, and the target-specific engineering is human throughout.
How the intruder got in is not known. The researchers state twice that the method of initial access was not evident and remains unknown. The agent's role begins after access already existed.
The work requiring knowledge of this particular ministry was done by a person: an exploitation chain built for its data stack, credential-testing scripts assembled from its own department abbreviations, and shellcode carrying hardcoded internal paths. The operator also modified a public enumeration script and, in the researchers' phrasing, provided it to the agent, then instructed it what to examine.
The researchers frame it as work an operator could have run by hand, which the logs show was instead automated.
The operation was documented through the attacker's own exposure
The campaign is documented because the operator left three directories publicly browsable on their own server while the operation was running. Those directories held 585 files and 470 MB of attack code and stolen credentials, and were captured before they disappeared.
| When | What happened |
|---|---|
| Mid–late June 2026 | Operation assessed to have commenced |
| 9–13 July 2026 | Three open directories archived by the researchers |
| 15 July 2026 | Thailand's CERT and NCSA notified; receipt acknowledged the same day |
| 23 July 2026 | Research published, eight days after notification |
| As of today | No breach confirmation from the Ministry of Finance |
The 9–13 July window is when the operator's infrastructure was exposed and captured — not when the intrusion happened. Those are frequently conflated.
The 9–13 July dates that appear in most summaries are when that infrastructure was exposed and archived. The operation itself is assessed to have begun in mid-to-late June — several weeks earlier.
The tooling mixes old exploits with 2026 research
| Staged exploit | Target | Age when used |
|---|---|---|
| CVE-2017-7269 | IIS 6.0 WebDAV | 9 years |
| CVE-2021-3156 | sudo heap overflow | 5 years |
| CVE-2021-4034 | polkit (PwnKit) | 5 years |
Old, reliable, widely patched. The contrast is with the scanner handed to the agent, which looked for three 2026 Linux kernel privilege-escalation flaws — a five-to-nine-year-old toolkit paired with current-year scanning.
The staged exploits are between five and nine years old and all long patched. The scanner given to the agent checked for three Linux kernel privilege-escalation flaws disclosed in 2026 — long-patched tooling for the foothold, current-year research for the phase after it.
What the research does and does not establish
The malware staged for this operation is a previously unreported implant, delivered in both Windows and Linux builds. ShadowPad, a backdoor associated with the same hosting infrastructure in 2025, was not deployed in this campaign; the researchers describe that earlier artefact as unrelated to the activity. A second command-and-control tool sits on the same server, and they state they have no evidence either confirming or denying it was used against the ministry.
On attribution, the researchers offer a low-to-medium confidence assessment that the operator is Chinese-speaking or intimately familiar with the language, drawn from infrastructure location and language indicators found in the recovered files. They name no group and assert no state sponsorship.
What Thailand has said
Thailand's national CERT and NCSA were notified on 15 July and acknowledged receipt the same day, ahead of a standard disclosure window. Neither the Ministry of Finance nor any Thai body has confirmed a breach. The ministry has not publicly acknowledged the incident and did not respond to press requests for comment.
The researchers' strongest statement is that active session cookies, deployed web shells and internal network access indicate the operator was able to compromise multiple systems on the ministry network. They attach caveats: cookie values establish that the operator reached a login panel but not that they logged in, deployment of certain payloads could not be confirmed, and there is no evidence files were exfiltrated.
Regional context
The target is a government finance ministry in ASEAN. The agent involved is a general-purpose open-source product under a permissive licence with a large user base, not a tool built for intrusion, which limits the options for restricting its use. The constraint being removed is not capability but the time enumeration takes.
It follows research showing rented cloud GPUs can disturb a power grid and a week in which an Iranian-linked group was documented using generative AI for phishing craft. In each case the technology lowers the cost of work that previously required people.
The caveats that matter
- No breach has been confirmed by Thailand. Everything here is the researchers' assessment of artefacts they recovered, not an official finding.
- Initial access is unknown. Stated twice in the research. Nothing here says the AI got in.
- We have withheld operational detail. No indicators, addresses, hashes, web shell paths or script internals appear here. They are in the original research for defenders who need them.
- The attribution is hedged at source and concerns language familiarity. We have not hardened it, and neither should anyone repeating it.
- "Unattended" is not "autonomous". The mode removes per-command approval prompts. It does not mean the agent selected its own objectives, and the logs do not show it doing so.
Key takeaways
- The AI did the legwork, not the break-in. All five recovered agent logs are post-exploitation reconnaissance.
- Initial access remains unknown, and the target-specific engineering was written by a person.
- ShadowPad was not used here — the research calls that artefact unrelated to this activity.
- Attribution is low-to-medium confidence about language, names no group, and asserts no sponsorship.
- The operator exposed themselves — 585 files on a publicly browsable server is why any of this is documented.
View author profile → · Editorial policy
