A threat actor allegedly used the open-source Hermes AI agent in an unattended ‘YOLO’ mode to automate post-exploitation activities during a breach of Thailand’s Ministry of Finance. The agent autonomously navigated the network, searching for root access methods and exfiltrating data. This incident highlights the emerging risk of AI agents being used to automate and accelerate cyberattacks, even without constant human oversight.