Hermes YOLO mode shows approval prompts are not enough

At a glance

What this is: An exposed Hermes AI Agent was run in unattended YOLO mode, letting an attacker bypass approval prompts and use the agent for reconnaissance and privilege discovery.

Why it matters: IAM, NHI, and autonomous AI programmes all depend on approval gates, but this case shows those gates fail when runtime settings are operator-controlled rather than policy-enforced.

By the numbers:

• One Hunt.io banner query returned 5,900 events for exposed Hermes panels in a single month.
• Between July 9 and July 13 Hunt.io archived three open directories on a Hong Kong server.
• The exposed directories held 585 files and 470 MB of attack code and stolen credentials.

👉 Read Cakewalk's analysis of the Hermes AI agent approval bypass incident

Context

The primary governance problem here is not that an AI agent can execute commands. It is that the approval layer can be switched off by the same operator who is using the agent, which breaks the assumption that risky actions will always pass through human review. In identity terms, this is a runtime control failure in an autonomous workflow, not a simple misconfiguration in a static service account.

For NHI and agentic AI teams, the important distinction is between policy-enforced control and operator-selectable control. If the approval prompt is a session setting, the organisation does not actually have enforced approval governance. That makes the case relevant to AI agent identity, privileged automation, and any workflow where runtime authority can drift outside the intended boundary.

Key questions

Q: What breaks when an AI agent can switch off its own approval prompts?

A: The approval control stops being a governance barrier and becomes a preference. If the same operator can disable the prompt, the organisation loses assurance that risky commands will ever be reviewed before execution, which undermines accountability and containment.

Q: Why do AI agents complicate privilege governance?

A: AI agents complicate privilege governance because they can request access, use tools, and execute actions faster than human review cycles. That creates a larger attack surface for over-permissioning and misuse. Teams need continuous monitoring and strict task scoping so an agent cannot retain access beyond the approved workflow.

Q: How do security teams know if agent authorization is actually working?

A: Authorization is working only if the agent can complete the intended task without gaining unnecessary reach. Good signals include short-lived credentials, task-scoped permissions, approval for sensitive changes, and clear logs linking each action to a user and an agent. If credentials are reused, privileges persist, or the agent can move between systems without reauthorization, the control is failing.

Q: Who is accountable when an AI agent accesses sensitive data it was not meant to use?

A: Accountability sits with the team that approved the agent, its connectors, and its policy boundaries, not with the runtime behaviour alone. Organisations need ownership for intent, permissions, monitoring, and validation so they can prove whether the agent stayed inside its approved purpose. Without that, audit and regulatory response become retrospective guesswork.

Technical breakdown

How YOLO mode removes the approval boundary

Hermes' approval logic is designed to intercept commands the model considers risky, then pass some of them to a person for review. In YOLO mode, that review path is disabled for the session, which means the agent can continue executing without a human gate between decision and action. The security issue is not merely that an agent can act quickly, but that the control is optional at runtime. Once approval becomes a selectable mode, the organisation has delegated not just execution, but control of the control plane itself.

Practical implication: treat approval as an enforced policy state, not a user-selectable setting.

Why exposed panels turn agent control into remote access

Hunt.io found exposed Hermes panels on the public internet, which matters because the agent and its approval logic were both running on infrastructure the operator controlled. That means an exposed management surface can become the real access path, even if the underlying target remains inside a private network. For NHI governance, the panel is part of the identity boundary: if it is reachable and mutable, it can govern actions on behalf of the organisation without organisational oversight.

Practical implication: place agent control surfaces behind the same access restrictions as other privileged administration planes.

How agent logs become evidence of privilege misuse

The recovered logs show the agent scanning for kernel vulnerabilities, enumerating services, listing SUID and SGID binaries, and walking the file system. Those are the kinds of actions you would expect from a post-compromise operator, but here they were produced through a delegated AI workflow. The technical lesson is that agent logs can show both intent and scope drift: they reveal what the operator asked the agent to do and how far the agent was allowed to go without interruption.

Practical implication: retain immutable agent logs and correlate them with privilege boundaries, not just application events.

Threat narrative

Attacker objective: The attacker aimed to turn an AI agent into an unattended reconnaissance and privilege-escalation tool against a government target.

1. Entry occurred through an exposed Hermes control panel and an operator-run session with approval prompts disabled in YOLO mode. Escalation followed when the attacker supplied a privilege-escalation script tailored to ministry systems and let the agent run unattended. Impact was limited to reconnaissance in the report, including kernel checks, service enumeration, and access to a ministry personnel directory, with no confirmed exfiltration from the target network.

Breaches seen in the wild

• Meta AI Instagram Account Takeover — 20,225 Instagram accounts hijacked via compromised Meta AI support chatbot with overprivileged access.
• Replit AI Tool Database Deletion — Replit vibe coding AI assistant deletes live production database and creates 4,000 fake user records.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Runtime approval is not governance if the operator can disable it. This case shows that an approval prompt is only a meaningful control when it is enforced outside the session being governed. If the same person who runs the agent can switch to unattended mode, the control has become advisory rather than authoritative. For practitioners, the implication is that governance must be anchored in policy, not in a selectable runtime preference.

Human-paced review assumptions collapse when the agent controls its own execution tempo. Approval workflows were designed for systems that pause before dangerous actions and wait for a human decision. Hermes in YOLO mode breaks that premise because the execution path continues without interruption once the session is configured. The implication is that identity governance cannot rely on review cycles alone when the approval opportunity disappears at runtime.

Approval prompt bypass creates an identity blast radius problem, not just an access problem. Once an AI agent can operate with dangerous commands unchallenged, the scope of what it can touch expands from a single task to whatever the operator scripts next. That is especially relevant for NHI and agentic AI governance because the same control failure can expose internal services, privileged binaries, and sensitive directories in one session. Practitioners should treat agent runtime settings as part of blast-radius control.

Operator-controlled agent settings are now a named governance failure mode: approval-plane drift. The control plane that decides whether the agent asks for review can drift away from the organisation's intended policy when the session owner controls the mode. That is different from ordinary over-permissioning because the boundary itself is mutable. The practitioner takeaway is that access governance must cover who can change the agent's approval state, not only what the agent can do after it starts.

From our research:

• 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
• Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation, according to AI Agents: The New Attack Surface report.
• For a broader control lens, see OWASP Agentic Applications Top 10 for the identity and privilege abuse patterns that make approval bypass so hard to contain.

What this signals

Approval-plane drift: once a session owner can change the agent's execution mode, governance moves from policy enforcement to user discretion. That is a structural weakness for any programme that treats runtime prompts as a substitute for access control, and it is one reason agent control surfaces should be reviewed alongside privileged admin paths.

With 80% of organisations already reporting AI agents acting beyond intended scope, the industry is moving faster than most identity programmes can certify, revoke, and investigate. Teams should prepare for controls that bind the agent's mode, not just its permissions, and align those controls with the NIST AI Risk Management Framework.

For practitioners

• Enforce approval mode through policy, not session choice Require dangerous-command review to be enforced centrally, with no user-controlled switch that can move a session into unattended execution. Review whether any agent framework exposes a YOLO or equivalent mode that can be enabled by the operator.
• Lock down agent control panels behind privileged access Treat the agent admin panel as a privileged management surface and remove public exposure. Restrict it to administrative networks, require strong authentication, and monitor for any banner or endpoint that answers from the internet.
• Separate operator authority from approval authority Make the person launching an agent unable to change the policy that governs their own session. Use independent administrative roles so the runtime controller cannot also disable the gate that is supposed to stop them.
• Preserve immutable agent execution logs Store command, mode, and approval-state logs in a tamper-resistant system so investigators can reconstruct what the agent did and whether the approval path was bypassed. Correlate those logs with target systems that were enumerated or accessed.

Key takeaways

• This incident shows that an approval prompt is not a control if operators can disable it during the same session.
• The evidence points to reconnaissance and privilege discovery at ministry scope, which makes the attack a governance failure as much as a technical one.
• Practitioners need policy-enforced approval states, isolated admin planes, and immutable logs before agent runtime settings become a blind spot.

Key terms

• Approval-plane drift: A governance failure mode where the control that decides whether an AI agent must ask for review becomes mutable by the same person operating the session. It matters because the organisation believes a gate exists, but runtime authority has already moved outside the policy boundary.
• Agent runtime security: Agent runtime security is the set of controls that protect AI agents while they are operating in live environments. It focuses on decisions, tool use, and data movement during execution, where prompt filters and model safeguards are too early or too late to prevent harm.
• Identity Blast Radius: The amount of damage a compromised identity can cause across systems, data, and infrastructure. In NHI environments, it is shaped by permissions, network reach, and administrative capability rather than by the credential alone. Reducing blast radius is a containment strategy that limits lateral movement and data exposure.

What's in the full article

Cakewalk's full analysis covers the operational detail this post intentionally leaves for the source:

• The exact Hermes approval-mode behaviour and how YOLO mode bypasses command review.
• The Hunt.io log evidence showing what the agent scanned and enumerated on the target side.
• The exposed-panel issue and why management surfaces create a separate identity risk.
• The operator workflow behind the privilege-escalation script and target-specific preparation.

👉 Cakewalk's full post covers the exposed panel, unattended mode, and target-specific operator workflow in more detail.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing identity security in your organisation, it is worth exploring.