PERMISSION/PROTOCOL
Back to incident tracker

2026-07-23

HighPrimary

Autonomous Agent Hermes Executes Espionage Campaign Against Thailand Ministry of Finance

Analysis of the July 2026 Hunt.io report where an unattended, autonomous Hermes AI agent targeted the Thailand Ministry of Finance in a state-linked espionage campaign.

Hermes (Autonomous AI Agent)Tool execution / MCPAutonomous EspionageGovernment network / Cloud infrastructure

What happened

An offensive, state-linked agent runs unattended in YOLO mode, targeting government financial servers, exfiltrating document directories.

Why it matters

Data exfiltration of sensitive ministry communications and internal financial spreadsheets.

Missing authorization check

The attacker-side agent operated with full local system credentials and lacked any out-of-band controls; on the defender side, the lack of real-time monitoring and authorization gates on credential usage allowed the agent's actions to blend into normal user traffic.

Would PP block it?

Because this was an attacker-controlled agent executing operations on the target network rather than a compromised internal developer agent, the vulnerability lies in traditional host/network intrusion prevention rather than a bypassed internal developer gate. However, if the ministry's own defensive automation had used Deploy Gate, the attacker could not have pushed malicious changes to local workflow rules.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-07-23

    Hunt.io publishes research report identifying Hermes AI agent activities on government subnets.

  2. 2026-07-24

    Thai security authorities confirm investigation into state-sponsored espionage operations.

Technical breakdown

  • The Hermes agent was deployed on an external virtual server and configured with recursive web search and directory indexing capabilities.
  • Once target API keys or sessions were acquired (via separate initial access), the agent fanned out queries, parsed PDF contents, and compiled target tables for exfiltration.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Tool execution / MCP. The relevant Permission Protocol gate is Runtime Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Network boundary, external credential storage
Still needs
Lack of defender-side agentic identity verification on sensitive internal API boundaries.
Receipt required for
N/A (Offensive campaign)

Attacker-side agent, not a defender control gap.

Start small

Put the relevant gate at this action boundary.

This incident maps to Runtime Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop