On July 23, 2026, threat intelligence firm Hunt.io published research on an intrusion at Thailand’s Ministry of Finance in which the operator used an off-the-shelf AI agent to automate post-exploitation work. Hunt.io’s Attack Capture system archived three simultaneous open directories on 43.246.208.207 between July 9 and July 13, 2026, totaling 585 files and 470 MB of attack code and stolen credentials.
The agent was Hermes, an open-source AI agent released in February 2026 that runs as a persistent daemon and accumulates memory across sessions. Its output logs show the operator ran it in unattended, or YOLO, mode, bypassing the approval prompts that would normally gate commands considered dangerous. In that mode it enumerated ministry hosts, traversed the file system, captured LinPEAS output from an adjacent host, performed recursive enumeration of a web root, and hunted for SUID and SGID binaries. The same directories held a previously undocumented cross-platform implant the operator internally named Hades, compiled as Go binaries in both Windows PE and Linux ELF form. Hunt.io assesses with low-to-medium confidence that the actors are Chinese-speaking or intimately familiar with the language, based on Hong Kong-hosted infrastructure and Chinese-language indicators.
What makes this significant is how ordinary the tooling is. There is no bespoke offensive model here: a commodity open-source agent, run with its safety confirmations switched off, did the tedious enumeration and privilege-escalation legwork that normally consumes an operator’s time. Because Hermes writes results to a predictable /hermes-results/ path with call_*.txt filenames, that same automation left a distinctive, indexable footprint, which is how Hunt.io found it.
For defenders, this is the practical shape of agentic offense in 2026. It is not a superintelligent adversary; it is a human attacker who scaled their own hands. The defensive implications are conventional but urgent: post-exploitation now happens faster than a human analyst’s review cycle, and the artifacts agents leave behind, including their own logs, are currently one of the better detection opportunities available.