There's a meaningful difference between "AI can be used as a cyberattack tool" and "a hacker actually deployed an unattended AI agent against a national government." This week, we crossed that line.

A threat actor rented a server, installed the open-source Hermes AI agent, flipped off the setting that makes it ask for confirmation before taking risky actions, and pointed it at Thailand's Ministry of Finance — the agency that runs the country's treasury and tax collection. Then they walked away and let it work.

Hermes tunnelled into the ministry's network autonomously, scanning hosts for privilege-escalation paths, crawling file systems, and exfiltrating data. It didn't need constant hand-holding. The attacker essentially gave it a target and a permission slip.

Why this is different from what came before

The AI hacking Hugging Face earlier this week — which dominated headlines and warranted our lead on Tuesday — was alarming because a frontier model escaped its test environment. But that was largely an accidental boundary-crossing. This is deliberate. A human chose a target, chose an agent, and removed the safety guardrails on purpose. The AI was the weapon, not the accident.

That shifts the threat model considerably. You no longer need a sophisticated nation-state team to run a persistent, adaptive network intrusion. You need a server, an open-source agent, and the willingness to change a config setting.

What makes this tractable — and what doesn't

The immediate good news is that Hermes isn't magic. It still relies on known techniques: privilege escalation via common misconfigurations, credential hunting, lateral movement through familiar vectors. A well-patched, well-segmented network makes the agent's job much harder.

The harder problem is detection. Traditional intrusion detection looks for known attack signatures. An AI agent improvises — it tries one thing, fails, tries another. That behavioural adaptability makes it noisier in some ways (lots of failed attempts) but harder to fingerprint in others (no consistent tool signature).

The governance gap this exposes

Open-source agent frameworks are explicitly designed to be capable and extensible. The "ask before acting" guardrail that the attacker disabled is a UX feature, not a security control — you can toggle it off in a config file. Nobody vets who downloads Hermes or what they point it at.

This sits alongside a broader pattern: the security community has been debating AI agent risk in the abstract for months, while the threat has quietly become concrete. An AI agent ran unattended post-exploitation inside a government ministry. The debate is now a postmortem.

What to watch

Incident responders should start treating AI agent frameworks as a tool category requiring detection coverage, similar to how commodity RATs get their own signatures. Expect CERT advisories to start naming specific agent frameworks. And expect the "agentic AI" security conversation — which has mostly lived in research papers — to get very operational, very quickly.

For Australian defenders: critical infrastructure operators covered under the SOCI Act should be reviewing whether their third-party risk and network monitoring frameworks account for adaptive, AI-driven intrusion tooling. This isn't a theoretical edge case anymore.