An attacker ran an agent in YOLO mode against a finance ministry.

Hey 👋

Last issue covered a model that escaped an evaluation sandbox and breached a real company. This one is about deliberate agent operations, and they turn out to be less exotic than the headlines suggest.

The attacker in the lead story used a public agent framework, flipped off the approval prompts, and pointed it at a ministry. Nothing about that required a frontier lab.

This week in AI security

An agent enumerated a ministry network unattended, then left its notes on the internet

Hunt.io and Bob Diachenko caught an intrusion against Thailand's Ministry of Finance while it was still running. Between July 9 and 13, three open directories on a Hong Kong server exposed 585 files: exploit code, web shells, HTTP tunnels, stolen mailbox credentials, a previously unreported Go implant the operator called Hades, and the logs of an AI agent doing the work.

The agent was Hermes, an open-source project released in February that runs as a persistent daemon with memory across sessions. The operator ran it in YOLO mode, which strips out the approval prompts for commands that would otherwise need a human to confirm. The recovered call logs show privilege escalation assessments, LinPEAS scans, SUID binary enumeration, container and filesystem listings, and a recursive walk of a web root belonging to the Office of the Permanent Secretary, cataloguing personnel records going back to 2012. Hunt.io found no evidence anything was exfiltrated.

The custom LinPEAS variant handed to the agent scanned for three 2026 Linux kernel privilege escalation CVEs. Everything around it was ordinary tradecraft: sudo and PwnKit exploits from 2021, an IIS 6.0 WebDAV module from 2017, a Hive UDF abusing HiveServer2's default authentication mode of NONE, and GlassFish scripts logging in with default credentials.

YOLO mode is not an attacker feature. It's the same toggle your developers use every day. Every serious agent framework ships one, whether it's called auto-approve, unattended, or a flag with "dangerously" in the name. The operator here didn't jailbreak anything and didn't need special access. They installed a popular open-source project and turned off the confirmations. That's the proliferation story, and it's why model-level safeguards aren't the control that matters for this threat class. Notice also what the agent did and didn't do. It handled the tedious enumeration while the human supplied objectives, target knowledge, and exploit staging. This isn't autonomous attack. It's an operator with a very fast junior analyst, which is what makes it reproducible at scale.

Find out which of your agents can run without approval, and write down what each one can execute. Approval prompts are a control, and like any control someone has probably disabled them for convenience in a place you haven't checked, including CI pipelines and developer laptops. For each agent that runs unattended, the question isn't whether you trust the model. It's what the blast radius is when a prompt goes wrong: which credentials it holds, which hosts it can reach, whether it can write. Then apply the mitigations from the report, because none of them are AI-specific. Check HiveServer2 authentication mode, change default GlassFish console credentials, patch sudo and polkit, and alert when a web server process opens an outbound connection to an internal service port.

Hunt.io research →

The best detection signal in that report is the agent's own output directory

Hunt.io included the part I'd have paid for. The Hermes web interface returns a distinctive HTTP fingerprint, and a single banner search across their data returned roughly 5,900 events of exposed panels in a month. The agent also writes results to a consistent path with predictable filenames, so a query against open-directory data returned 575 hosts serving agent output files with no authentication at all. An operator's live working notes, publicly readable.

Agents generate artifacts, and artifacts are evidence. This operation was caught because the agent's working directory was on the internet. That cuts both ways. On defense it means a running agent leaves a rich, timestamped record of its reasoning and commands, which is better forensic material than most systems produce. It also means that record is a target: your agent's working directory holds its findings, the credentials it touched, and a map of what it reached. In issue #20 I argued the findings database from a scanning fleet deserves crown-jewel treatment. Same principle, sharper example, and this time the attacker made the mistake for us.

Locate your agents' working directories and decide who can read them. Not the application logs, the scratch space where agents write intermediate output. Confirm it isn't served by any web root, isn't sitting in a public bucket, and has access control of its own. Then use it. Ship those files into your log pipeline as a detection source, because per-agent command records are the highest-fidelity signal you have about what an agent actually did. Both halves matter. The artifact is your best evidence and your worst leak.

Thirty-seven companies just agreed that agent security is an infrastructure problem

NVIDIA and 36 other organizations launched the Open Secure AI Alliance on July 27, prompted by the Hugging Face incident from last issue, and specifically by the guardrail lockout that pushed Hugging Face onto a self-hosted open-weight model for its forensics. Founding members include Microsoft, IBM, Cisco, Cloudflare, CrowdStrike, Palo Alto Networks, Red Hat, Hugging Face, and the Linux Foundation, building on the Foundation's Akrites initiative and OpenSSF work. OpenAI, Anthropic, and Google are not among them.

The stated scope is the full agent stack: identity, permissions, isolation, guardrails, logs, model formats, multi-model scanning, and secure coding workflows. The first technical contribution is NOOA, an Apache 2.0 research framework from NVIDIA aimed at making agent behavior easier to test, trace, audit, and govern. The alliance also went to policymakers, arguing open models should be treated as defensive assets rather than liabilities.

Read the scope list, not the press release. Identity, permissions, isolation, logs. That's a containment stack, and it's a real shift to see it framed as the agent security problem by a coalition this size, rather than prompt filtering or model alignment. The policy fight over open weights will get the coverage, and there's a fair argument on both sides that I'll leave to the participants. What changes your work is whether any of this becomes a real standard for agent identity and audit logs, because right now every team builds that layer from scratch. An alliance is an intention, not an implementation, and the open-washing risk stays real until there are execution milestones. One detail I can't ignore: Nous Research, which publishes Hermes, is a founding member. The ecosystem that produced this week's attack tool is the same one organizing the defense. That's the ordinary condition of security tooling, not a scandal.

Nothing to adopt yet, but pick your integration points now. If you're building agent identity, audit logging, or isolation this quarter, keep the interfaces loose enough to swap in a standard later. Track NOOA if you need agent behavior tracing you can inspect yourself. And take the lesson from the incident that prompted all this: have a capable model you can run on your own infrastructure staged in your IR toolkit before you need it.

NVIDIA announcement →

From the lab

Everything or Nothing: The Missing Middle in AI Agent Authorization is the long version of the YOLO question above. Connect-time consent versus runtime enforcement, and why approved once isn't the same as allowed now. Read it →
The Enterprise AI Harness Everyone Is Building Has No Security Layer covers where the approval toggle actually lives. The harness, not the model, is where unattended execution gets decided. Read it →

Talks confirmed: MCPcon Amsterdam in September on MCP security, and fwd:cloudsec Europe London, September 7 and 8, on running an SRE agent with read access across a Kubernetes fleet. The unattended-execution question in this issue is one of the rungs. If you'll be at either, come find me.

Tooling worth knowing

GitHub and PyPI are now using time as a control. Dependabot applies a default three-day cooldown before opening update pull requests, and PyPI blocks new files on releases older than 14 days to stop poisoning of trusted versions. The reasoning is that malicious packages are usually caught fast, so delay alone removes most of the exposure window. Worth pausing on for agent deployments: a coding agent that resolves and installs dependencies on its own moves faster than any cooldown protects, because the control assumes a human review cycle that agents skip by design. If your agents install packages, pin with lockfiles, scope their tokens, and disable install scripts in CI, which is what GitHub recommends alongside the cooldown.
Agent Security Scorecard: my free self-assessment against the OWASP Agentic Top 10, about 12 minutes, no login. The unattended-execution and identity questions above are in it. Score your agents →

One thing to check this week

List every agent in your environment that can execute a command without a human approving it. For each one, write two columns: what credentials it holds, and what it can reach.

If the list takes more than an hour to build, that difficulty is the finding. It's the same finding the Thai ministry's attacker was counting on at the other end.

What I'm watching

→ Agent panels exposed on the public internet. A single fingerprint search surfaced thousands of Hermes instances. Attackers running agents are leaking their operations, and organizations running agents are leaking theirs. Expect scanning services to index agent control panels as a standard asset class, and check whether yours is already in one.

→ Whether the alliance ships an identity standard. Every agent deployment I assess builds workload identity from scratch. A credible open standard there would matter more than any model release this year.

I write the full technical deep-dives on the aminrj.com blog: agent security patterns, lab tests, framework breakdowns. If this newsletter is useful, that's where the long-form work lives →.

Questions, pushback, something I missed, reply directly. I read everything.

Cheers, Amine