The "AI Hacking" Hype: What Really Happened at the Thai Finance Ministry
The headlines are easy to write: "AI Agent Hacks Government!" It's a great hook, and it sells. But when you dig into the details of the attack on Thailand's Ministry of Finance, it's not the AI that's the story. The underlying issues are familiar: human errors, critical misconfigurations, and a persistent failure to implement fundamental security practices, which will be detailed throughout this analysis.
This wasn't an AI agent autonomously deciding to breach a network. This was an operator, likely Chinese-speaking, using an open-source assistant called Hermes AI agent in its "YOLO" (You Only Live Once) mode. That's a deliberate choice to disable safety prompts, turning a helpful tool into an unattended, risky script runner. The system, when configured in YOLO mode, worked exactly as designed, which ultimately became the problem.
How a Misconfigured Hermes AI Agent Ran Wild
The initial compromise of the Thai Ministry of Finance web server isn't fully clear, but the attacker had already planted a hidden web shell and written scripts targeting internal Hadoop systems. They even hardcoded stolen mailbox passwords into a mail-testing script. This wasn't Hermes's doing; this was a human operator establishing a foothold.
Once inside, the operator deployed Hermes AI agent, an open-source assistant from Nous Research. Hermes isn't built for hacking. It's for managing mail, running chores, taking instructions. But it has a "YOLO" mode, which, as the project's configuration guide warns, should "only use this in trusted, sandboxed environments." The attacker ignored that. They activated it via a command-line flag, an environment variable, or an in-session command, effectively telling Hermes: "Don't ask, just do."
With its safety off, Hermes went to work. It started scanning ministry hosts for kernel vulnerabilities, running `LinPEAS` scripts for Linux privilege escalation, sweeping for elevated-permission binaries, and listing filesystems. It even recursively crawled the web root of the Office of the Permanent Secretary, pulling down office documents, performance evaluations, and personnel records dating back to 2012.
The key distinction here is that Hermes didn't decide to do these things. It was instructed to do them, and its "YOLO" mode let it execute without human confirmation for each risky step.
The Real Vulnerabilities: Old Flaws and Default Settings
While the AI agent garnered headlines, the true vulnerabilities lay in the core security failures. The attack chain relied on classic vulnerabilities and misconfigurations. First, the internal Hadoop cluster was running with its default authentication mode set to `NONE`. This meant it accepted any password without verification, effectively allowing unauthenticated access.
Second, the attacker staged exploits for several Linux kernel flaws, including Copy Fail (CVE-2026-31431), Dirty Frag (CVE-2026-43284 and CVE-2026-43500), and DirtyClone (CVE-2026-43503), which were only weeks old. They also had exploit code for older, well-known vulnerabilities like `polkit` (CVE-2021-4034), older `sudo` versions, and even IIS 6.0 WebDAV. While it's unconfirmed if these exploits actually ran, their presence indicates a target environment likely riddled with unpatched systems.
Finally, the entire operation's logs, 585 files, and 470 MB of attack tooling were found by Hunt.io and researcher Bob Diachenko on a web server with directory listing enabled. This exposed tooling is how the incident came to light; the operator left the evidence lying around for anyone to find.
The attacker also used other tools: a Python script (`hive_rce_py2.py`) to connect to the vulnerable HiveServer2, and a malicious Java add-on (`HiveCmd.jar`) to enable command execution via database queries. A previously undocumented Go implant, "Hades," was also found, built for both Windows and Linux, though there's no evidence it reached a ministry machine.
The operator's origin IP was in Hong Kong, and language clues like a Chinese word in the Hermes web interface password and a FOFA key suggest a Chinese-speaking or fluent individual. This isn't a nation-state attack, but a methodical, opportunistic one.
What This Means for Everyone Else
For the Thai Ministry of Finance, the practical impact is significant: sensitive personnel and performance data was accessed. Although no evidence of exfiltration was found in the recovered files, the possibility cannot be ruled out. The fact that an attacker could crawl through years of internal documents is a serious confidentiality breach.
This incident serves as a stark reminder that the "AI Hacking" narrative is misleading. Instead of AI going rogue, this was a human operator using a tool with disabled safeguards to exploit basic, well-understood security weaknesses.
How to Stop the Next One
Thailand's national CERT and cybersecurity agency were notified on July 15, but as of July 24, no public statement had been made. The lack of a public statement is concerning, as transparency is crucial for collective learning and defense.
While the necessary mitigations aren't new, they remain essential. A critical first step involves hardening Hadoop environments: verify if HiveServer2 is running with `authentication set to NONE` and restrict who can install user-defined functions.
Beyond configuration, vigilant monitoring of internal network traffic is essential. Set up alerts for web server processes attempting to connect to internal Hadoop ports (like 10000, 50070), as web servers should not be communicating with internal databases in this manner without explicit justification.
Proactive hygiene extends to web server roots, where attackers often hide persistent access. Recursively search for PHP files with leading-dot names (e.g., `/storage/Counter/nine/.journald-cache.php`), as these often indicate hidden web shells.
Ultimately, the most enduring defense against these well-known attack vectors lies in rigorous, consistent patching. Patch kernels against the four 2026 flaws mentioned, update `sudo` to version 1.9.5p2 or later, apply the patch for `polkit` CVE-2021-4034, and if IIS 6.0 WebDAV installations are still present, patch them or, preferably, decommission them entirely.
Beyond technical mitigations, fostering a strong security culture is paramount. Regular security awareness training for all personnel, emphasizing the dangers of social engineering and the importance of strong password hygiene, can significantly reduce the human error factor that attackers so often exploit. Furthermore, implementing robust incident response plans and conducting periodic security audits and penetration testing can help identify and remediate vulnerabilities before they are exploited.
The Thai Finance Ministry incident underscores that even with advanced tools like the Hermes AI agent, the foundational principles of cybersecurity remain critically important. Rather than sophisticated AI, the attacker exploited basic vulnerabilities like exposed directories, default configurations, and unpatched systems. The Hermes AI agent was just a faster way to run `LinPEAS` and crawl files. The true narrative here isn't about advanced AI capabilities, but rather the persistent failure to address fundamental security hygiene.
