AI Assistant Turned Loose on Thai Finance Ministry Network

Key points

• An attacker installed an AI coding assistant called Hermes on a rented server and pointed it at Thailand's Ministry of Finance, which runs the country's tax collection and treasury.
• The attacker turned off the safety setting that makes the AI ask permission before running risky commands, letting it work through the network unattended.
• The AI agent ran its own reconnaissance, looking for ways to gain root, meaning the highest level of control over a computer.
• Security researchers say this is one of the first clearly documented cases of an AI agent being used for hands-off post-exploitation, the stage of a hack that comes after the initial break-in.
• The incident raises fresh questions about whether AI assistants should ship with the ability to be run in fully autonomous mode at all.

Someone rented a server, installed a popular AI assistant on it, and switched off the setting that makes it stop and ask before running dangerous commands. They then pointed the AI at Thailand's Ministry of Finance, the government body that collects the country's taxes and manages its treasury. The AI got to work on its own.

That is the story laid out in research first reported by The Hacker News, describing what may be the clearest public example so far of an AI agent being used for post-exploitation, the stage of a hack where an intruder has already got a foot in the door and is looking around inside.

What did the AI actually do?

The agent, called Hermes, ran reconnaissance across the ministry's network without a human at the keyboard. It checked machines for ways to gain root access, meaning full administrator control, and searched file systems for anything useful.

Normally an AI coding assistant will pause before running a command that could damage a system, waiting for the person using it to click yes. The attacker turned that guardrail off. From that point the agent could decide for itself which commands to try next, in what order, based on what it found.

That is the shift that matters. Older hacks needed a person to type each command or to write a custom script for each target. Here the tooling was off-the-shelf, and the strategy came from the model.

Why does this matter beyond Thailand?

It matters because the barrier to running a competent intrusion just dropped. You no longer need years of offensive-security experience to poke through a government network. You need a credit card, a cloud server, and the willingness to click past a warning dialog.

This is not really an authentication story, in the sense of someone stealing a password. Would multi-factor authentication have helped? Probably not at the stage the AI was working. By then the attacker was already inside. MFA protects the front door. This was someone wandering the corridors.

What it is, honestly, is an authorisation story. The AI agent was given permissions it should never have had in autonomous mode, and nobody was checking what it did with them.

Should ordinary people be worried?

Not immediately, and not in the way a leaked customer database would worry you. There is no public indication that taxpayer records were stolen or published. Thai citizens do not need to change passwords today because of this specific incident.

The wider worry is slower and structural. If governments and large companies cannot detect an AI quietly enumerating their networks, the next incident, or the one after that, will involve data that does touch ordinary lives. Health records. Benefit payments. Tax files.

What should defenders take from this?

Two things. First, network monitoring needs to catch the pattern of automated reconnaissance, not just known malware signatures. An AI agent running rapid-fire enumeration commands looks different from a human admin, and that difference is detectable.

Second, any organisation letting staff use AI coding assistants on internal systems needs a clear rule about autonomous mode. If the tool can run commands without asking, someone needs to know exactly where it is allowed to run them, and everything it does needs to be logged where a human will actually read the log.