Skip to content
PERMISSION/PROTOCOL
Back to incident tracker

2026-07-23

HighPrimary

Autonomous Agent Hermes Executes Espionage Campaign Against Thailand Ministry of Finance

Analysis of the July 2026 Hunt.io report where an unattended, autonomous Hermes AI agent targeted the Thailand Ministry of Finance in a state-linked espionage campaign.

Hermes (Autonomous AI Agent)Tool execution / MCPAutonomous EspionageGovernment network / Cloud infrastructure

What happened

An offensive, state-linked agent runs unattended in YOLO mode, targeting government financial servers, exfiltrating document directories.

Why it matters

Data exfiltration of sensitive ministry communications and internal financial spreadsheets.

Missing authorization check

Not applicable: the agent was operated by the attacker, outside any boundary the victim controls.

Would PP block it?

No authorization boundary inside the victim's environment sits between this agent and its operator, because the operator is the adversary. Permission Protocol constrains agents acting under an organization's own authority.

Incident analysis

Timeline and technical read

Timeline

  1. 2026-07-23

    Hunt.io publishes research report identifying Hermes AI agent activities on government subnets.

  2. 2026-07-24

    Thai security authorities confirm investigation into state-sponsored espionage operations.

Technical breakdown

  • The Hermes agent was deployed on an external virtual server and configured with recursive web search and directory indexing capabilities.
  • Once target API keys or sessions were acquired (via separate initial access), the agent fanned out queries, parsed PDF contents, and compiled target tables for exfiltration.

Authorization boundary

Where the authorization boundary should have been

This incident is categorized as Tool execution / MCP. The relevant Permission Protocol gate is Runtime Gate. The read is conditional: the block only applies where the real action boundary is routed through a gate.

If enforced at
Network boundary, external credential storage
Still needs
Lack of defender-side agentic identity verification on sensitive internal API boundaries.
Receipt required for
N/A (Offensive campaign)

The agent in this incident was operated by the attacker, not by the victim. Permission Protocol secures internal agent boundaries, not external network perimeters.

Start small

Put the relevant gate at this action boundary.

This incident maps to Runtime Gate. Start with the boundary that controls the actual action, then require a signed receipt before execution.

Replay this incident with a signer in the loop