SURIQ
An artificial intelligence (AI) agent ran the intrusion at Thailand's Ministry of Finance, and that headline is the least useful thing about it. Strip the novelty away and the tradecraft is ordinary. Someone rented a server, dropped a consumer AI assistant onto it, told the assistant to stop pausing for approval, and aimed it at the ministry. Waiting on the other side were a data service that answered with no password and a stack of privilege-escalation bugs that have been patchable for years. The AI contributed reach and speed. Ordinary neglect contributed the way in.
The account comes from Hunt.io, together with independent researcher Bob Diachenko, who documented the operation after the attacker's own staging server was left with directory listing switched on, exposing 470 MB of tooling spread across roughly 585 files. The target runs Thailand's treasury and tax collection. Thai authorities were notified in mid-July 2026, and the public writeup landed on July 24. Investigators found active session cookies, planted web shells, and access to several internal systems, though no proof that documents were taken.
The agent bought labor, not capability
The assistant is Hermes, an open-source tool from Nous Research built for ordinary chores like managing mail over Telegram or Slack. Nothing about the incident is a flaw in Hermes itself. The operator ran it in its permissive "YOLO" mode, which skips the human-approval prompt before each command, and let it work the network on its own. It ran LinPEAS, a standard Linux privilege-escalation scanner, searched for over-privileged binaries, enumerated the filesystem, and indexed personnel records reaching back to 2012.
Look at how the agent actually got in and got root, and the AI angle shrinks. Initial command execution came from an Apache HiveServer2 (the SQL front end to Hadoop) that answered with its authentication mode set to NONE, according to Hunt.io's findings as reported by The Hacker News. From there the operator's tooling loaded a malicious Hive user-defined function to execute shell commands under the Hive service's own account. The escalation stage was a menu of old bugs: PwnKit (CVE-2021-4034) in polkit, the 2021 sudo heap overflow (CVE-2021-3156), and a 2017 IIS WebDAV flaw, per Security Affairs. A customized LinPEAS also probed four 2026 Linux page-cache vulnerabilities. None of that is a capability the agent invented. It is the path a mid-tier human operator would have taken, run faster and with nobody watching each step.
An autonomous operator is easier to catch, not harder
The reflex reaction to "the AI ran the attack" is that detection just got harder. The evidence points the other way. Handing the keyboard to an agent stripped out the human judgment that normally cleans up after an intrusion, and it left a louder trail than a careful operator would.
Start with how the campaign was found: the staging server sat on the internet with directory listing enabled and 470 MB of tooling in plain view. Hunt.io also notes the agent's web interface ships a recognizable HermesWebUI server header, which internet-wide scanning tied to roughly 5,900 events in a month, and that its output lands in a predictable /hermes-results/ folder exposed on around 575 separate instances. The tooling that saved the operator time became the fingerprint that mapped the whole operation. Automation without a human editor produces exactly this kind of self-disclosure.
Detect the actions, not the operator
Here is the practitioner takeaway, and it is a reassuring one. You do not need a detection that recognizes "an AI did this." The commands an agent runs land on the host exactly like commands a human runs. LinPEAS looks like LinPEAS whether a person or a language model launched it. A web service opening a socket to an internal Hadoop control port is an east-west anomaly regardless of who is behind it. Build your alerting around what executed, not around who typed it.
| Step | What happened on the host | Host signal to watch |
|---|---|---|
| Entry | HiveServer2 reachable with authentication set to NONE, then a malicious Hive function ran OS commands | An analytics or web service spawning a shell; a new function or JAR loaded into HiveServer2 |
| Privilege escalation | A LinPEAS sweep probed for PwnKit, the 2021 sudo overflow, and 2026 Linux page-cache bugs | LinPEAS-style enumeration bursts; sudo or polkit exploit attempts on a server |
| Recon | Recursive filesystem walk and personnel folders read back to 2012 | A service account mass-reading files far outside its normal path |
| Internal reach | A web host opened connections to internal Hadoop control ports 10000 and 50070 | East-west traffic from a web server into internal database or big-data ports |
| Staging | A Go implant staged for Windows and Linux; PHP web shells hidden as leading-dot files | A new dotfile PHP in a web root; an unsigned Go binary beaconing out |
Two of those signals deserve emphasis. The entry point was not a zero-day; it was a big-data service exposed with authentication turned off. Analytics stacks like Hadoop, Hive, and Ambari, and admin consoles like GlassFish, get stood up on internal networks and rarely get the threat-modeling a public web app receives. They are the soft underbelly, and that is where the agent went. The escalation target list, meanwhile, mirrors the last two years of Linux root bugs. The four 2026 page-cache vulnerabilities the custom LinPEAS checked for are the same family behind the in-memory root exploits we covered. Patch PwnKit, the sudo overflow, and the 2026 page-cache set, and this escalation chain breaks no matter who is driving.
We have watched this pattern build
This is not the first time an autonomous agent has done an attacker's hands-on work. We wrote about an AI agent that breached Hugging Face and the first ransomware run end to end by an AI agent. The through-line across all three is the same. The agent lowers the skill and labor cost of an intrusion, but it does not change the atoms of the attack. Someone still has to leave a service unauthenticated. Someone still has to skip the patch. The AI just reaches the door faster.
On attribution, stay careful. Hunt.io assessed with low-to-medium confidence that the operator was Chinese-speaking, citing Hong Kong hosting, a Chinese-language artifact in the agent interface, and infrastructure linked to earlier ShadowPad and VShell activity. No specific threat group has been named, and the assessment is tentative. Treat it as a lead, not a conclusion.
Close the unauthenticated data service first
The order of operations here is not glamorous. Before you build a detection for agentic attackers, find the HiveServer2 instances, the Hadoop endpoints, and the admin consoles on your internal network and confirm none of them answer with authentication set to NONE. Then confirm the polkit, sudo, and 2026 Linux page-cache patches are on every host. Then wire an alert for a web or analytics service that spawns a shell or reaches an internal database port. This intrusion succeeded on ordinary neglect. It fails on ordinary hygiene.