What happened
Hunt.io and researcher Bob Diachenko found three exposed directories on infrastructure hosted in Hong Kong. The directories reportedly contained 585 files totalling about 470 MB, including exploit code, webshells, tunnelling tools, scripts, credentials, compiled payloads and AI-agent session logs. Some artefacts named systems and internal addresses associated with Thailand’s Ministry of Finance.
Five recovered Hermes call logs showed the agent being instructed to search for privilege-escalation opportunities, enumerate services, inspect containers, find SUID and SGID binaries, traverse file systems and use a customised LinPEAS script. The agent was configured in an unattended mode that removed prompts requiring human approval for dangerous commands.
The evidence does not show that the agent independently chose the target or obtained initial access. Researchers described an operator providing objectives and tools while the agent automated portions of post-exploitation. Thailand’s Ministry of Finance has not confirmed a breach, and some artefacts demonstrate targeting rather than successful compromise. Hunt.io said ThaiCERT and the National Cyber Security Agency acknowledged its notification.
Why this matters now
The practical change is scale and tempo. Each observed task is familiar to incident responders, but an agent can execute and adapt across them without waiting for a human operator between commands. Detection programmes based on isolated command rarity may miss the significance of a rapid sequence whose individual elements resemble ordinary administration.
The same control problem exists internally. Enterprise agents used for development, operations or security testing may possess shells, cloud credentials and network access. An unattended mode can turn a narrow instruction or compromised workflow into sustained activity beyond the intended boundary.
The decision for security leaders
Ask detection engineering to model the sequence rather than the brand name: initial webshell access, high-rate enumeration, privilege discovery, credential use, container inspection and broad file traversal. Prioritise velocity, scope expansion and machine-identity anomalies as linking signals.
Require governance for internal agents with command execution. The control record should identify available tools, approval mode, identity, accessible environments, outbound paths, logging and a kill mechanism. Security testing should verify isolation instead of accepting configuration claims such as blocked internet access at face value.
Evidence of closure
- Detection tests demonstrating visibility into rapid privilege, service, container and file-system enumeration.
- An inventory of internal agents authorised to execute code or commands, including owners, credentials, egress and approval modes.
- A validated containment procedure capable of disabling abused machine identities and isolating hosts without extended manual coordination.
- A forensic-analysis fallback that keeps sensitive attack material inside an approved environment.
The Security.io assessment
The recovered logs are stronger evidence than a vendor demonstration, but they do not establish a confirmed Ministry compromise or a wholly autonomous attack. Security.io assesses that they credibly demonstrate operational use of a general agent to accelerate human-directed post-exploitation.
Defenders do not need speculative artificial-general-intelligence scenarios to act. The immediate requirement is to detect ordinary attacker behaviour occurring at automation speed and to ensure the enterprise’s own agents cannot reproduce the same containment failure.
Questions for the morning meeting
- Which autonomous tools inside the company can execute commands without per-action approval?
- Would existing detections distinguish a fast AI-driven operator from legitimate automation?
- Can responders analyse exploit payloads and command logs without sending sensitive evidence to an external model provider?