Attack infrastructure exposed: 585 files, ~470 MB (Source: Hunt.io / Bob Diachenko research (July 24, 2026))
No Human Approved a Single Step
Researchers at Hunt.io found three open directories on a Hong Kong-hosted server between July 9 and July 13, 2026, containing 585 files and roughly 470 megabytes of attack tooling, stolen credentials, session logs, and — unusually — logs from an AI agent named Hermes. The logs show Hermes running in what its own documentation calls 'YOLO mode,' a configuration flag that skips command-approval prompts entirely. In that mode, the agent independently ran a customized privilege-escalation scan, enumerated services and SUID binaries, inspected containers, and catalogued PDFs, DOCs, and spreadsheets in web directories tied to Thailand's Ministry of Finance, including a personnel-records folder dating back to 2012. Thailand's Ministry of Finance has not confirmed a breach; researchers describe the exposure as evidence of targeting and post-exploitation activity, not confirmed data theft.
This Is Not the First Time
The distinguishing detail in this incident isn't the target — it's the absence of a person during execution. Hermes Agent is an open-source framework from Nous Research, released in February 2026, built for persistent, self-directed operation. 'YOLO mode' is documented by its own creators as the single highest-risk setting, meant to be disabled in production. Here, it was left on during an intrusion. That pattern has a precedent. Anthropic disclosed in November 2025 that a state-linked group it designated GTG-1002 used Claude Code to run roughly 80 to 90 percent of an espionage campaign against about 30 organizations — reconnaissance, exploitation, credential harvesting, lateral movement, and exfiltration — with human operators stepping in only at a handful of decision points. Anthropic's own assessment was direct: the barriers to running a sophisticated intrusion have dropped substantially.
Eight months later, Sysdig's threat research team documented what it called the first fully agentic ransomware chain: an LLM-driven agent that entered through CVE-2025-3248, an unauthenticated remote-code-execution flaw in the open-source AI-building framework Langflow, then independently harvested cloud and API credentials, moved laterally to a separate production target, encrypted a database, and destroyed data — start to finish, without an operator at the keyboard. The pattern connecting all three cases is the same: the skill an attacker needs is shrinking, and the software doing the work is publicly downloadable.
Governments Are Already Writing Guidance
In April 2026, six national cybersecurity agencies co-published joint guidance, 'Careful Adoption of Agentic AI Services,' recommending that organizations restrict agent permissions and avoid unattended, broad-access configurations — the exact setting implicated in the Thailand exposure. The advisory predates this incident by three months, which suggests the risk was already recognized before this specific case surfaced, not invented by it. Separately, Check Point's 2026 Cyber Security Report measured Thai organizations facing an average of 3,201 attacks per week in the first half of 2025 — 164 percent above the global average of 1,968 — establishing Thailand as an already target-dense environment independent of this specific tool.
The Stack Behind the Front End Still Matters
WebPulse's July 2026 sample tracks roughly 466,000 detected sites across 30 fingerprinted web frameworks — and none of the systems named in the Thailand exposure (Hadoop, Apache Ambari, a GlassFish admin console, a custom PHP web shell) sit inside that fingerprint set. That gap is itself the point for budget-signers: an autonomous agent in unattended mode doesn't check what's serving the homepage before it starts enumerating what's behind it. The framework choice that shows up in a scan is one layer. The administrative consoles, backend services, and file shares sitting behind that layer are where post-exploitation actually happened here, and an agent with approval prompts turned off will walk through all of it at machine speed, on its own schedule, whether or not a person is watching.
