AI Agents Are Now Running Cyberattacks Unsupervised

Security researchers have uncovered two separate incidents in which criminals allowed an autonomous AI agent to operate with little or no human oversight during a live intrusion — one against a Thai government ministry and one carried out by a ransomware operation from start to finish.

Researchers increasingly warn that cybercriminals no longer need to type every command themselves. Two recent investigations show attackers handing entire stages of an intrusion over to autonomous AI agents and letting them run unsupervised, a shift that experts say lowers the technical bar for damaging attacks.

Threat intelligence firm Hunt.io, working with independent researcher Bob Diachenko, discovered three open web directories exposed on a Hong Kong-hosted server between July 9 and July 13, 2026. The directories contained nearly 600 files totaling roughly 470 MB, including exploit code, web shells, HTTP tunneling utilities, stolen credentials, compiled malware, and operational logs.

The files repeatedly referenced systems belonging to Thailand's Ministry of Finance by name, hostname, and internal IP address. Scripts in the cache targeted the ministry's Hadoop data cluster, its Apache Ambari management console, a GlassFish administration panel, internal mail servers, and a PHP web shell traced back to a ministry web server.

Researchers also linked the staging server to two further hosts in Malaysia and Hong Kong through shared TLS certificate fingerprints, and recovered a previously undocumented Go-based implant that the operator named "Hades."

The most notable find, however, was a set of logs generated by Hermes, an open-source autonomous AI agent built by Nous Research. The operator had switched on the tool's "YOLO mode," a setting that removes the prompts normally requiring human sign-off before the agent runs potentially dangerous commands.

With that safeguard disabled, Hermes could scan for kernel vulnerabilities, enumerate services, hunt for privilege escalation paths, inspect containers, and run a customized version of the LinPEAS enumeration script against a ministry host without waiting for approval at each step.

In one recorded task, the agent was instructed to search a web directory linked to the Office of the Permanent Secretary for Finance, which cataloged PDF, DOC, and XLS files, including performance reviews and personnel records dating back to 2012. Hunt.io found no evidence that this data was removed from the network, and the Ministry of Finance has not confirmed a breach. Hunt.io and Diachenko notified Thailand's national CERT and its National Cyber Security Agency on July 15, and both organizations acknowledged the report the same day.

Released in February 2026, Hermes is described by its developer as a self-improving agent that retains memory across sessions and can be operated from a terminal or through chat platforms such as Telegram and Discord. Official documentation confirms that its approval system can be switched off entirely, "YOLO mode", either with a command-line flag, a chat toggle, or an environment variable, so that dangerous commands execute without a person confirming them first.

The documentation notes that a small hardcoded blocklist of catastrophic actions, such as wiping a filesystem, still applies even in this mode, but nearly everything else runs unchecked. The project's popularity has grown quickly, and by July 2026, its GitHub repository had attracted more than 200,000 stars, making it one of the most widely deployed open-source agent frameworks.

A similar pattern in the JadePuffer ransomware case

The Thailand findings followed closely on the heels of another disclosure involving cloud security firm Sysdig, which identified what it believes is the first fully AI-driven ransomware operation, dubbed JadePuffer. According to Sysdig, an autonomous agent handled the entire attack chain on its own:

• reconnaissance and initial access through a known Langflow remote-code-execution flaw, CVE-2025-3248
• credential theft, lateral movement to a MySQL server, and privilege escalation using an authentication-bypass bug in Alibaba Nacos, CVE-2021-29441
• deployment of a ransomware payload that encrypted more than 1,300 configuration records before deleting the originals and leaving a Bitcoin ransom demand

Sysdig reported that the agent adjusted its approach when steps failed, at one point correcting a broken login attempt within roughly half a minute, and that the generated code included natural-language comments that described its reasoning. The company concluded that the case shows "agentic threat actors" have moved from theory to practice, reducing the skill required to run a serious intrusion.

Sysdig's own write-up of the case adds considerably more detail about how the agent behaved once it had a foothold. After exploiting the Langflow flaw, the LLM reportedly worked through two separate targets rather than one: the exposed Langflow host itself, which served only as a stepping stone, and a separate production database server that appears to have been the actual objective.

On the Langflow machine, the agent enumerated the system, dumped Langflow's own backing Postgres database for stored credentials, and swept the environment in parallel for a wide range of secrets, including API keys for several AI providers, cloud credentials with specific attention paid to Alibaba, Tencent, and Huawei naming conventions, cryptocurrency wallet material, and database configuration files.

It also queried an exposed MinIO object storage service using default administrative credentials, listed every bucket it could reach, and pulled a credentials file by name before installing a cron job that quietly beaconed to the attacker's infrastructure every 30 minutes.

From there, Sysdig says the agent pivoted to the real target, a MySQL server paired with an Alibaba Nacos configuration service, using root-level database credentials whose origin the researchers could not determine. It attempted to create a rogue administrator account in Nacos, and when its first attempt failed, the agent diagnosed the problem, revised its approach, and successfully logged in with a corrected account roughly 31 seconds later.

Sysdig singles out this sequence as some of the clearest evidence that a model, rather than a fixed script, was driving events, since a scripted tool would typically either succeed on a known path or fail outright rather than reason through a specific error and adjust course within seconds. The agent went on to probe for ways to escape into the underlying container, including attempts to read the Docker socket and process metadata, before moving into the destructive phase of the operation.

Sysdig also flags an unresolved detail in the ransom note itself: the Bitcoin address the operation used to demand payment matches a widely reproduced example address that appears throughout public Bitcoin documentation, raising the possibility that the model pulled it from its training data rather than being handed a real payment address by its operator.

The researchers also found that the encryption key used to lock the victim's data was generated randomly and never stored or transmitted, meaning the data could not have been recovered even had the victim paid the ransom.

Sysdig frames JadePuffer less as a single dangerous new tool and more as a preview of a broader trend, arguing that agentic ransomware sharply lowers the expertise required to run a full extortion operation while leaving unusually legible traces of the agent's own reasoning that defenders could learn to spot.