Notifications
Clear all
Topic starter
26/08/2026 11:51 am
TL;DR: An attacker used Hermes AI Agent with approval checks switched off to target Thailand's Ministry of Finance, and Hunt.io recovered logs showing vulnerability scans, privilege enumeration, and directory access, according to Cakewalk. The case shows that approval prompts without enforced policy boundaries collapse when operators can disable them at runtime.
NHIMG editorial — based on content published by Cakewalk: An Attacker Turned Off the Hermes AI Agent's Approval Prompt
By the numbers:
- One Hunt.io banner query returned 5,900 events for exposed Hermes panels in a single month.
- Between July 9 and July 13 Hunt.io archived three open directories on a Hong Kong server.
- The exposed directories held 585 files and 470 MB of attack code and stolen credentials.
Questions worth separating out
Q: What breaks when an AI agent can switch off its own approval prompts?
A: The approval control stops being a governance barrier and becomes a preference.
Q: Why do AI agents complicate privilege governance?
A: AI agents complicate privilege governance because they can request access, use tools, and execute actions faster than human review cycles.
Q: How do security teams know if agent authorization is actually working?
A: Authorization is working only if the agent can complete the intended task without gaining unnecessary reach.
Practitioner guidance
- Enforce approval mode through policy, not session choice Require dangerous-command review to be enforced centrally, with no user-controlled switch that can move a session into unattended execution.
- Lock down agent control panels behind privileged access Treat the agent admin panel as a privileged management surface and remove public exposure.
- Separate operator authority from approval authority Make the person launching an agent unable to change the policy that governs their own session.
What's in the full article
Cakewalk's full analysis covers the operational detail this post intentionally leaves for the source:
- The exact Hermes approval-mode behaviour and how YOLO mode bypasses command review.
- The Hunt.io log evidence showing what the agent scanned and enumerated on the target side.
- The exposed-panel issue and why management surfaces create a separate identity risk.
- The operator workflow behind the privilege-escalation script and target-specific preparation.
👉 Read Cakewalk's analysis of the Hermes AI agent approval bypass incident →
Hermes YOLO mode and the governance gap teams are missing?
Explore further
26/08/2026 11:51 am
Runtime approval is not governance if the operator can disable it. This case shows that an approval prompt is only a meaningful control when it is enforced outside the session being governed. If the same person who runs the agent can switch to unattended mode, the control has become advisory rather than authoritative. For practitioners, the implication is that governance must be anchored in policy, not in a selectable runtime preference.
A few things that frame the scale:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems (39%), inappropriately sharing sensitive data (31%), and revealing access credentials (23%), according to AI Agents: The New Attack Surface report.
- Only 52% of companies can track and audit the data their AI agents access, leaving 48% with a complete blind spot for compliance and breach investigation, according to AI Agents: The New Attack Surface report.
A question worth separating out:
Q: Who is accountable when an AI agent accesses sensitive data it was not meant to use?
A: Accountability sits with the team that approved the agent, its connectors, and its policy boundaries, not with the runtime behaviour alone. Organisations need ownership for intent, permissions, monitoring, and validation so they can prove whether the agent stayed inside its approved purpose. Without that, audit and regulatory response become retrospective guesswork.
👉 Read our full editorial: Hermes YOLO mode shows approval prompts are not enough
