Hermes AI Agent YOLO模式駭泰國財政部：開源自主代理淪駭客武器 | Hermes AI Agent YOLO Mode Hacks Thai Ministry: Open-Source Agent as Weapon

By Kit 小克 | AI Tool Observer | 2026-08-01

🇹🇼 Hermes AI Agent YOLO模式駭泰國財政部：開源自主代理淪駭客武器

Hermes AI Agent是Nous Research打造、GitHub上擁有超過7.3萬星的開源自主AI代理工具，主打「放著跑也能持續進化、記得上下文」。但2026年7月，資安研究團隊Hunt.io與研究員Bob Diachenko揭露，駭客竟直接把這套開源AI Agent開成攻擊工具，鎖定泰國財政部發動間諜式入侵——這是目前為止最清楚的一次「自主AI代理被武器化打真實政府單位」案例。

什麼是「YOLO模式」，為什麼危險？

Hermes預設會在執行危險指令前跳出提示，等人類按下確認才繼續執行——這是多數AI Agent框架共通的安全機制。但只要加上--yolo參數，這層確認就會被整個關掉，代理可以無人值守、自己一路把指令跑完，非常適合「全自動化」場景，也非常適合駭客。

攻擊怎麼發生的

研究團隊在7月9日到13日間，於一台香港代管的伺服器上發現三個對外開放的目錄，裡面躺著585個檔案、共約470MB的攻擊程式碼與竊得的憑證。從留下的紀錄可以看到，操作者只需要下達目標與可用工具，接下來系統列舉、權限提升、檔案與服務探測、內網偵察等例行滲透動作，全部交給開啟YOLO模式的Hermes自動完成，操作者幾乎不用手動介入。

研究人員還在同一批外洩檔案中，發現一支先前未被通報過的Go語言後門，操作者內部代號叫「Hades」。目前泰國財政部尚未證實系統確實遭入侵，部分跡證顯示某些系統只是被鎖定為目標，不代表已成功得手。Hunt.io與Diachenko已於7月15日通報泰國國家電腦網路危機處理中心（ThaiCERT）與國家網路安全局，雙方也已確認收到通報。

對開發者與企業的啟示

這起事件的重點不是Hermes本身有漏洞，而是任何具備YOLO/自動核准功能的AI Agent，只要落入惡意操作者手中，都能被拿來加速整套攻擊鏈。如果你的團隊也在用類似的自主代理工具（不論是Hermes、還是Claude Code、AutoGPT一類框架）：

正式環境或對外主機上，避免長期開啟免確認的自動執行模式
幫AI Agent的操作留下完整、不可竄改的日誌，方便事後稽核
把AI Agent的執行環境當成需要最小權限與網路隔離的高風險資產處理
定期檢查伺服器是否有未預期對外開放的目錄或服務

AI Agent愈來愈強、愈來愈能「自己把事情做完」，但這次事件說明，攻擊者也一樣樂於借用這股自動化力量。安全機制不能只靠工具內建的確認提示，架構層面的權限管控才是真正的防線。

好不好用，試了才知道。

🇺🇸 Hermes AI Agent YOLO Mode Hacks Thai Ministry: Open-Source Agent as Weapon

Hermes AI Agent is Nous Research's open-source autonomous AI agent, with over 73,000 stars on GitHub, built to run unattended and get smarter the longer it operates. In July 2026, threat intelligence firm Hunt.io and researcher Bob Diachenko disclosed that attackers had turned this exact open-source AI agent into an offensive tool, running an espionage campaign against Thailand's Ministry of Finance. It is the clearest case yet of an autonomous AI agent being weaponized against a real government target.

What Is "YOLO Mode" and Why It's Dangerous

By default, Hermes pauses before executing risky commands and waits for a human to approve, a safety pattern common across most agent frameworks. Adding the --yolo flag strips that confirmation step entirely, letting the agent run unattended from start to finish. That is exactly what makes it useful for full automation, and exactly what makes it useful for attackers.

How the Attack Unfolded

Between July 9 and 13, researchers found three open directories on a Hong Kong-hosted server containing 585 files, roughly 470MB of attack code and stolen credentials. Logs showed the operator only needed to supply objectives and tooling; the routine post-exploitation work, system enumeration, privilege escalation, file and service discovery, network reconnaissance, was handled automatically by Hermes running in YOLO mode, with almost no manual intervention required.

The same leaked files revealed a previously unreported Go-language implant the operator called "Hades." Thailand's Ministry of Finance has not confirmed a successful breach; some evidence only shows systems were targeted, not compromised. Hunt.io and Diachenko notified ThaiCERT and Thailand's National Cyber Security Agency on July 15, and both confirmed receipt.

What This Means for Developers and Enterprises

The takeaway isn't that Hermes has a bug, it's that any AI agent with a YOLO or auto-approve mode becomes an attack accelerant the moment it falls into the wrong hands. If your team runs similar autonomous agent tooling, Hermes, Claude Code, AutoGPT-style frameworks, or otherwise, consider:

Avoid leaving auto-approve or unattended execution modes permanently enabled on production or internet-facing hosts
Keep complete, tamper-resistant logs of everything the agent executes, for post-incident review
Treat the agent's runtime environment as a high-risk asset requiring least privilege and network isolation
Periodically audit servers for unexpectedly exposed directories or services

AI agents are getting more capable at finishing tasks with less supervision, but this incident shows attackers are just as happy to borrow that automation. Safety can't rely solely on a tool's built-in confirmation prompt; architectural access control is the real line of defense.

好不好用，試了才知道 - you won't know until you try it.

Sources / 資料來源

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

Claude Code 實測：AI 幫你寫程式到底行不行？ | Claude Code Review: Can AI Really Code for You?

3月 26, 2026

閱讀完整內容

搜尋此網誌

AI小貼士