An Attacker Turned Off the Hermes AI Agent's Approval Prompt
1One Setting Removed the Approval Step
An attacker working against Thailand's Ministry of Finance ran an open-source AI agent with its approval checks switched off. The threat-intelligence firm Hunt.io reported the operation on July 23, 2026, after finding the agent's own logs on a server the attacker had left exposed. The agent is Hermes, running a setting called YOLO mode.
Hermes output logs show the operator ran the agent in unattended or YOLO mode, bypassing approval prompts for commands that could be considered dangerous.
Hunt.io
Between July 9 and July 13 Hunt.io archived three open directories on a Hong Kong server. They held 585 files and 470 MB of attack code and stolen credentials, along with the agent's logs. Five of those logs record what the agent did. It scanned for kernel vulnerabilities, enumerated services, listed the programs that run with elevated privileges (SUID and SGID binaries) and walked the file system. The fifth covers a ministry web directory holding personnel records going back to 2012. Hunt.io saw no sign that any of those files left the network.
2A Person Still Chose the Target
The operator instructed the agent, handed it a privilege-escalation script customized for ministry systems and let it work without stopping to ask. Hunt.io describes an operator who invested significant preparation into penetrating a single government target. Hunt.io also notes the project passed 140,000 GitHub stars by July 2026 and is among the most widely deployed publicly available agent frameworks.
Most of the tools here are ones we have seen before. The combination is what stands apart: an AI agent coordinating the work, a cross-platform implant holding access, and scripts written for this specific target.
Hunt.io
The approval prompt is a weaker control than it sounds. Hermes defaults to what its documentation calls smart approvals, where an auxiliary model rates each flagged command, clears what it reads as low risk, denies what it reads as clearly dangerous and passes only the uncertain cases to a person. A mode that asks about every dangerous command exists, though someone has to turn it on. YOLO mode drops the prompts entirely for that session. Both the agent and its approval logic ran on infrastructure the operator controlled. Nothing on the ministry's side registered a decision. Those control panels are not hard to find. One Hunt.io banner query returned 5,900 events for exposed Hermes panels in a single month. Any company running an agent framework can check its own approval mode tonight and whether its panel answers from the public internet.
Source: Hunt.io, "Thailand's Ministry of Finance Targeted With Hermes AI Agent Running Unattended, Hades Implant Staged", July 23, 2026.