AI agents have started automating attacks—are our defenses truly ready?

To keep up with schedules, the business team quickly set up the LLM assistant and Agent workflows. By the time the security team noticed, these components had already quietly connected to APIs, credentials, and internal databases.

This "get on the bus first, buy the ticket later" shadow AI application is becoming the most vulnerable flank of enterprises.

The AI Agent ransomware case that has triggered industry discussions in the past two days pinpoints exactly this painful spot: the attackers didn't use any metaphysical tactics; they simply targeted those "shadow AI applications" in the enterprise that were run first and had no one to properly close them up later.

Just how rampant is this "AI-automated penetration"? Look at a real attack recently disclosed overseas and you'll know.

After gaining access to the internal network, the attacker directly connected to an open-source AI Agent and enabled the "fully automated mode" (YOLO Mode) which requires no manual confirmation. Next, from system enumeration and sensitive file searches to network reconnaissance and privilege escalation attempts, the entire complex penetration process was left to the AI for autonomous trial and error, moving forward in a chain reaction. The hacker didn't even need to type commands one by one at the terminal.

This is not a concept demonstration in a lab—the target of this attack was directed straight at the Ministry of Finance of Thailand.

The breakthrough point that allowed such automated tools to smoothly intrude was precisely those neglected temporary AI services within the enterprise. These temporary applications labeled as "demo", "test", or "internal" were often initially created just for the developers' convenience. However, as they quietly interfaced internally with APIs, credentials, and internal databases, a hidden channel spanning the connection layer and straight to the real business system had already taken shape in the dark.

Temporary AI application services that enjoyed green lights all the way eventually evolved into exposed real risk surfaces.

Part 01

What is the "YOLO Mode" of fully automated attacks?

On July 23, a security research team disclosed a cyber espionage activity targeting the Ministry of Finance of Thailand.

Researchers found hundreds of public files on the attacker-controlled server, including attack scripts, WebShells, stolen credentials, authentication cookies, AI Agent operation logs, and scripts written specifically for the internal systems of the Ministry of Finance. Some files indicated that the attacker had already accessed multiple systems within the Ministry of Finance.

Incident File Public Research Information

Target - Systems related to the Ministry of Finance of Thailand

AI Tool - Open-source AI Agent Hermes

Operation Mode - Enable YOLO mode, skipping manual approval prompts for dangerous commands

Involvement Phase - Post-penetration activities such as system enumeration, file search, network reconnaissance, and privilege escalation opportunity screening

Fact Boundary - The initial entry point remains unclear, and the Ministry of Finance of Thailand has not yet publicly confirmed the full intrusion situation

The AI tool involved in the attack is named Hermes, an open-source Agent. The attacker enabled its "YOLO Mode".

This name sounds a bit casual, but the actual permissions are not casual at all. According to the security documentation of the Hermes project, in normal mode, commands involving dangerous operations require manual approval; once YOLO mode is turned on, these approval prompts are skipped, and the Agent can continuously execute generated commands.

The logs recovered by researchers show that Hermes undertook tasks such as system information gathering, internal file searching, network reconnaissance, and privilege escalation opportunity screening during the attack. The attacker also prepared a backdoor named Hades to maintain access, execute remote commands, and transfer files.

Related report illustration, Source: The Record

Fact Boundary

It is currently unclear how the attacker initially entered the network. A more accurate statement would be: the attacker first obtained access to part of the system, and then used the AI Agent to advance post-penetration activities.

Part 02

Digital Thugs Unafraid of Failure: Trial-and-Error Costs Reduced to Zero

Internal network reconnaissance is not mysterious.

Checking system versions, digging through directories, looking for configuration files, enumerating services, organizing host relationships, and then deciding the next step based on the results. In traditional attacks, most of these tasks are executed one by one by humans. If they fail, they change parameters, change scripts, or try another path.

AI Agents are well-suited to take over this kind of work. It can understand the returned result of the previous command, continue to select tools, adjust actions, and string together information across different systems. The attacker still determines the target and direction, while the Agent is responsible for running a large number of trivial operations.

Task Rhythm after Agent Takes Over

Read the scene: Identify systems, directories, services, and current permissions.

Choose the next step: Adjust tools, parameters, or targets based on the returned results.

Continue trying after failure: Analyze errors, and then switch to another path for execution.

Organize attack results: Hand back scattered information to the attacker to continue advancing the task.

In traditional attacks, once the hacker leaves the keyboard, the penetration is interrupted. But Agents have changed this—as long as a target is given, it will, like an untiring thug, constantly analyze errors, adjust thinking, and automatically try and err, turning originally patience-consuming, trivial operations into background tasks that can be run in batches.

This also explains why "YOLO Mode" is worth paying attention to. Without manual confirmation, the speed is indeed faster; once the Agent gets stolen credentials, scripts, and internal network access capabilities, it will also probe forward more boldly.

Part 03

Behind Fragmented Alerts, a Hard-to-Reconstruct Attack Chain

From the defensive perspective, most of the actions left by this type of attack are not new.

Abnormal command execution, credential usage, directory scanning, internal network detection, privilege escalation scripts, and backdoor communication are all things the security team usually sees. The trouble lies in the rhythm and combination.

The Agent will continuously adjust its actions based on the results of the scene. For the same target, it may do information gathering first, switch to another path after failure, and then call another script. Looking at each log individually, some look like O&M operations, and some are just failed requests. Once scattered across terminals, network devices, identity systems, and SOCs, the original attack path can easily be broken.

A high number of alerts does not mean the security team can reconstruct the process.

This type of incident requires the defensive side to retain sufficient context: who logged into which host at what time, what commands were executed subsequently, what configurations were read, and what internal services were accessed. If the context is broken, analysts have to flip through records back and forth among several systems.

As Agents string together attack actions faster and faster while security operations still rely on manual log splicing, the time pressure will naturally fall on the latter.

Part 04

The Effectiveness of the Defensive Line Must Be Re-tested Through Actual Combat

When encountering attacks involving AI Agents, existing protection doesn't need to be completely torn down and rebuilt. Command execution, credential abuse, lateral access, and backdoor communication still fall within the enterprise's existing detection capabilities.

First confirm whether these capabilities are truly effective on site.

You can select several behavior paths close to this incident and run them in a controlled environment: can abnormal commands be detected by endpoint security products, will internal network reconnaissance trigger alerts from network IPS or NTA full-traffic products, does the identity system react when stolen accounts access across hosts, and can audit logs be correlated to the same path after entering the SOC.

Running through this often reveals some problems that are not easily exposed normally. A certain device has logs but they didn't enter the SOC; a certain rule can trigger an alarm but lacks account and host context; the handling process is written very completely but gets stuck on owner confirmation once actually triggered.

This is also the value of security validation in AI attack scenarios. It does not predict what command the Agent will generate next time, but instead needs to check and confirm daily whether those deployed detection and response capabilities can still work normally when facing a continuously changing attack path.

Part 05

AI Begins to Run Processes on Behalf of Attackers

This incident did not conjure up a completely new set of attack methods out of thin air. Entry points, permissions, credentials, and backdoors—these links still exist. The change is that repetitive work such as system reconnaissance, file searching, network detection, and privilege escalation screening can now be left to AI Agents for continuous execution.

Hermes is just one example. In the future, more Agents will enter the attack workflow, and YOLO mode won't always be called by this name. For security teams, what really needs to be watched closely is whether these tools, after accessing the existing environment, can continuously call commands, access internal systems, and leave clear enough clues when abnormal behavior occurs, as well as whether the first-time automated response is working normally.

This type of scenario is also suitable for running through security validation in advance. Put behaviors close to real attacks into a controlled environment to see if endpoints can detect them, if networks can alert, if the SOC can string together scattered logs, and if the response process can continue down the line. The Agent's actions will continuously change, but whether the defensive chain can keep up is only known after on-site validation. It is also suitable for continuous daily verification through security validation to confirm that all security products, platforms, and workflows are operating normally as expected.

Reference Sources: Hunt.io: Thailand’s Ministry of Finance Targeted With Hermes AI Agent Running Unattended The Record: Hackers used autonomous AI agent to spy on Thailand’s finance ministry Dark Reading: AI Agent Drives Espionage Attack on Thai Ministry of Finance Hermes Agent Security Documentation: YOLO Mode

Intelligence-driven Operations, AI Builds Closed-loop

▶▶ Follow [Cyble Tech] to learn about practical security operations with AI closed-loops, and get more product updates and practical security information ▶▶ Follow [Cyble Threat Intelligence] to unlock in-depth threat intelligence and vulnerability analysis from a first-line perspective, and get first-hand security research content