Hacker Runs Hermes AI Agent Unattended for Post-Exploitation at Thai Finance Ministry

Summary

An unidentified operator ran the open-source Hermes AI agent (from Nous Research) unattended, in its documented permission-bypassing YOLO mode, to conduct autonomous post-exploitation against Thailand's Ministry of Finance, which runs the country's treasury and tax collection. The agent iteratively scanned hosts for privilege-escalation paths, hunted file systems, and crawled a folder of staff personnel records dating to 2012.^[0]

The intrusion was human-initiated: the operator was already inside before the agent started, having planted a hidden web shell and written custom scripts against named internal Hadoop systems. The agent automated the repetitive scan-read-decide loop, but nothing recovered shows it selecting the target or discovering a new vulnerability. No safety control exposed the operation; a web server left with directory listing enabled did, allowing Hunt.io and Bob Diachenko to recover 585 files and about 470 MB of tooling.^[0]

The exploitation hinges on well-understood defaults and known flaws: Apache HiveServer2's default authentication mode of NONE (accepting any password), a malicious Java user-defined function (HiveCmd.jar) for command execution, and staged exploits for four 2026 Linux kernel LPE flaws plus older polkit, sudo, and IIS 6.0 issues. Nothing recovered demonstrates data leaving the network, and the initial access vector remains unknown.^[0][18]

Attack chain

1. Initial access (unknown): The operator was already inside the ministry network before the agent was launched; how initial access was obtained is unknown. A hidden web shell was planted on a ministry web server at /storage/Counter/nine/.journald-cache.php, disguised as a system cache file that does not appear in normal directory listings.^[0]
2. Tooling and agent staging: On a rented staging server (accessed via SSH from 103.97.0.57 in Hong Kong) the operator installed Hermes and enabled YOLO mode to remove the human approval step, then staged a customized linpeas.sh, LinPEAS, kernel-exploit checks, a Hades Go implant in 62 copies, and Hadoop attack scripts.^[0]
3. Autonomous reconnaissance and privilege-escalation hunting: Five call_00_*.txt log files show the agent running kernel vulnerability scans against a ministry host, two LinPEAS runs, a sweep for elevated-permission (SUID/capability) binaries, a filesystem listing, and a recursive crawl of the web root of the Office of the Permanent Secretary.^[0]
4. Hadoop compromise and command execution: The hive_rce_py2.py script connected to HiveServer2 on internal port 10000, exploited the default NONE authentication mode, and installed the HiveCmd.jar user-defined function to run operating-system commands as the Hive service account and read results through database queries.^[0][18]
5. Data access (no confirmed exfiltration): The agent read a directory containing Office documents, performance evaluations, and personnel records dating to 2012, but none of the recovered logs show the files leaving the network.^[0]

Disclosure timeline

How it works

Apache HiveServer2's default authentication mode is NONE, which accepts whatever password it is given without validating it. The hive_rce_py2.py script connects to HiveServer2 on internal port 10000, authenticates with any password, and installs a malicious Java user-defined function (HiveCmd.jar). Cloudera warns that anyone able to install such a UDF can run arbitrary code as the Hive service account and reach sensitive data, effectively turning ordinary database queries into OS command execution.^[0][18][19]

The staged custom linpeas.sh checked four 2026 Linux kernel local-privilege-escalation flaws across three families: Copy Fail (CVE-2026-31431), Dirty Frag (CVE-2026-43284 and CVE-2026-43500) and DirtyClone (CVE-2026-43503). Each grants a local user root where its prerequisites hold; for Dirty Frag and DirtyClone that prerequisite is the CAP_NET_ADMIN capability. Nothing recovered names a ministry kernel version or shows any of the four actually ran.^[0][17]

Hermes's YOLO mode is a documented feature, not a flaw, that removes the per-command human approval prompt via a --yolo launch flag, a /yolo mid-session command, or the HERMES_YOLO_MODE=1 environment variable. A hardline blocklist still refuses commands that would wipe the agent's own host, so the operator disabled the human check rather than every safeguard.^[0]

Affected versions and patch status

Indicators of Compromise

Key takeaways

• Unlike vendor-hosted AI abuse (e.g. the Chinese group manipulating Claude Code that Anthropic detected and banned), Hermes runs on the operator's own machine, so no vendor is watching and there is no account to ban; the safeguard that failed the operator was an exposed directory listing, not any AI safety control.^[0][10]
• The AI agent automated only the repetitive reconnaissance loop; the human still performed the target-specific work, including a password list built from the ministry's own department abbreviations and shellcode with hardcoded ministry intranet paths.^[0]
• The exploitation relied on ordinary weaknesses—Apache Hive's default NONE authentication, a malicious Hive UDF, and known kernel/polkit/sudo/IIS flaws—so endpoint defenders see the same commands and tools whether or not a human is at the keyboard.^[0]

Defensive actions

• Check whether HiveServer2 is running with authentication set to NONE and restrict who can install user-defined functions.: That default is exactly what the operator's hive_rce_py2.py script was written to rely on to gain code execution via HiveCmd.jar.^[0][18][19]
• Alert when a web server process opens a connection to internal Hadoop ports such as 10000 or 50070.: A web server reaching a Hadoop node is anomalous and matches the observed pivot from the compromised web server into the Hive cluster.^[0]
• Recursively search web roots for PHP files with leading-dot names that imitate system caches.: The recovered web shell sat at /storage/Counter/nine/.journald-cache.php and does not appear in normal directory listings.^[0]
• Patch kernels against the four 2026 LPE flaws, update sudo to 1.9.5p2 or later, patch polkit for CVE-2021-4034, and remediate any remaining IIS 6.0 WebDAV.: Exploit code and a customized scanner for all of these were staged for privilege escalation during the intrusion.^[0]
• Hunt for the HermesWebUI server header and the /hermes-results/ folder with predictable filenames.: The agent leaves its own trail regardless of safety settings; these artifacts identify exposed Hermes-based operator infrastructure.^[0]