Updated August 13, 2026.
In July 2026, attackers used an autonomous AI agent in an operation against Thailand’s Ministry of Finance. But it was Hermes, not OpenClaw. Hunt.io researchers found the agent’s logs, malicious implants, web shells, stolen credentials, and tools for lateral movement. The initial entry vector and whether any files were exfiltrated from the ministry have not been established.
In brief: the operator ran Hermes in unrestricted/YOLO mode, disabling confirmation prompts for dangerous commands. The agent automated reconnaissance, file enumeration, and privilege escalation path discovery. It sped up post-exploitation, but it did not “decide on its own” to attack the government: the attacker set the goals and access.
This article is intended for security leaders, AI agent developers, and owners of digital workflows. We explain the incident from a defensive perspective and do not publish instructions that would make it easier to reproduce the attack.
Contents
- What happened
- Why this was Hermes, not OpenClaw
- What the attack chain looked like
- What is confirmed and what remains unknown
- What role YOLO mode played
- What the Hades implant is
- Who was behind the attack
- How to protect systems from autonomous agents
- FAQ
- How AI dawn can help limit the risk of AI agents
- Conclusion
What happened
From July 9 to 13, 2026, the Hunt.io platform detected three open directories on a server in Hong Kong. They contained 585 files totaling 470 MB: code for known CVEs, web shells, HTTP tunnels, stolen credentials, scripts for Thailand’s Ministry of Finance infrastructure, and Hermes logs.
On July 15, Hunt.io and researcher Bob Diachenko notified ThaiCERT and Thailand’s National Cyber Security Agency. Receipt of the message was confirmed the same day, and publication was delayed for the standard seven-day disclosure window. The initial Hunt.io report was published on July 23; Dark Reading published an independent analysis on July 28.
Researchers found signs of compromise on several systems inside the ministry’s network: active session cookies, deployed web shells, internal addresses, and command execution logs. However, the materials found did not allow them to determine how the initial intrusion occurred.
Why this was Hermes, not OpenClaw
Hermes and OpenClaw belong to the same class of open agent systems: they run for long periods, retain memory, and can execute commands through tools. That makes them easy to mix up in retellings. But the attribution in this incident is specific.
Hunt.io found the Hermes WebUI configuration, the hermes-results directory, and five files with agent call logs. The report explicitly says the operation was largely carried out by Hermes in unattended/YOLO mode. There is no evidence in these sources that OpenClaw was used in the attack on Thailand’s Ministry of Finance.
This distinction matters for more than branding. The defense team needs to look for the right artifacts, processes, and network indicators. A generic “OpenClaw did this” conclusion leads to incorrect detection rules.
What the attack chain looked like
| Stage | Observed action | AI agent role |
|---|---|---|
| Initial access | unknown | not established |
| Infrastructure preparation | servers, tunnels, web shells, and an exploit-code set | operator environment |
| Reconnaissance | enumeration of hosts, services, files, and SUID/SGID | Hermes executed commands and processed output |
| Privilege escalation | running LinPEAS and analyzing known vulnerabilities | Hermes automated path checking |
| Data access | searching for PDFs, DOCs, XLS files, and personnel records | the agent recursively enumerated directories |
| Persistence/C2 | Hades, web shells, proxies, and persistence | separate malicious components |
| Exfiltration | not confirmed | there is no evidence that the discovered documents were exfiltrated |
This was not a fully autonomous attack. The operator already had the infrastructure, tools, and access, while the agent carried out a significant portion of the routine post-exploitation work.
What is confirmed and what remains unknown
| Claim | Status |
|---|---|
| The target was Thailand’s Ministry of Finance infrastructure | confirmed by names, addresses, and ministry-specific scripts |
| Hermes ran without approval prompts | confirmed by configuration and logs |
| Multiple systems were compromised | confirmed by web shells, cookies, and internal access |
| The agent enumerated documents and personnel records | confirmed by call logs |
| The documents were exfiltrated | not confirmed |
| Initial access is known | unknown |
| A specific state-sponsored group carried out the attack | not established |
Dark Reading separately received confirmation from Hunt.io that no evidence of data exfiltration from the ministry was found. The absence of evidence does not prove exfiltration did not happen; it only limits the report’s fair conclusion.
What role did YOLO mode play
YOLO mode disables confirmation prompts before potentially dangerous actions. This mode saves operator time, but it turns a mistaken or harmful model decision into a real command without a pause.
In this incident, Hermes was performing system reconnaissance, analyzing LinPEAS, searching for files, and continuing the chain of actions without manual approval at each step. Autonomy increased speed and the volume of logs, but it did not change the objective: the agent was operating in an attacker-controlled environment.
For a legitimate company, unrestricted mode is unacceptable for production access. Reading sensitive directories, changing permissions, network scanning, and sending files should be blocked by policy or require separate confirmation outside the LLM.
What is the Hades implant
Hunt.io found 62 Windows and Linux binaries, some of which were called Hades. Analysis of two samples showed shared Go code: interactive shell, persistence, file transfer, SOCKS proxy, and in-memory code execution. The Windows version could also take screenshots.
Hades was a separate malicious implant and persistence channel. Hermes helped with reconnaissance and post-compromise actions, while Hades provided traditional C2 capabilities. Mixing them into a “virus-AI” is technically incorrect.
Who was behind the attack
Researchers saw Hong Kong infrastructure, Chinese-language indicators, a password containing a Chinese word, and a FOFA platform key. The server had previously been used as a ShadowPad controller. Based on that, Hunt.io gave only a low-to-medium confidence assessment: the operator was Chinese-speaking or highly familiar with the language.
This is not attribution to a state or a specific APT group. The server’s geography and the language of artifacts can be spoofed, and previous use of the IP by other malware does not prove a common owner.
How to protect systems from autonomous agents
- Disable unattended/YOLO mode for accounts with production access.
- Separate reading, modifying, and sending data into different roles and credentials.
- Require external approval for commands that change permissions, networks, or files.
- Store agent logs in a persistent protected directory, not in
/tmp. - Restrict outbound connections with an allowlist and analyze unusual traffic.
- Scan skills/plugins as part of the supply chain and pin versions.
- For Hadoop, check HiveServer2 authentication and the UDF blocklist.
- Look for hidden PHP/JSP web shells and update sudo, polkit, and legacy IIS.
Singapore’s Cyber Security Agency in its advisory on OpenClaw recommends the same class of measures: least privilege, sandboxing, network controls, persistent logging, and human approval for critical actions. These principles also apply to Hermes.
FAQ
Did the AI agent decide on its own to hack the government?
No. The attacker controlled the infrastructure and instructed the agent to carry out actions within the operation. Hermes automated a significant part of post-exploitation in no-confirmation mode.
Was this OpenClaw?
No. The initial report identified Hermes WebUI, Hermes configuration, and Hermes logs. There is no evidence of OpenClaw in this incident.
What data was stolen?
The agent listed office documents and HR records, but Hunt.io found no evidence that they were exfiltrated. Initial access also remained unknown.
How was the attack discovered?
The operator left three directories on the staging server exposed. Hunt.io archived them through Attack Capture and reconstructed the infrastructure, tools, and agent logs.
Why does this case matter?
It shows the shift from using an LLM as an adviser to automating real commands after compromise. That speeds up reconnaissance and increases scale, even though classic vulnerabilities, credentials, and C2 still remain the basis of the attack.
How AI Dawn helps limit the risk from AI agents
AI Dawn can audit the process and data, design agentic RPA with least-privilege access, separate tools by trust zone, and implement logging, approval for dangerous actions, and prompt-injection tests. For closed environments, the team can deploy an on-premise LLM and integrate it with corporate systems through controlled gateways.
The first step is to choose one process, document its baseline, data sources, constraints, and acceptance criteria. Discuss the task.
Conclusion
The attack on Thailand’s Ministry of Finance is one of the most thoroughly documented cases of an autonomous AI agent being used in cyber espionage. But the correct wording is: Hermes in YOLO mode automated post-exploitation; OpenClaw does not appear in the report.
Confirmed: internal access, web shells, stolen credentials, reconnaissance logs, and Hades. Not confirmed: initial access, document exfiltration, and state attribution. The main lesson for business is to control not the model’s “intelligence,” but the actual permissions, network access, confirmations, and observability of every action.