Topic starter
26/08/2026 11:51 am
TL;DR: An attacker used Hermes AI Agent with approval checks switched off to target Thailand's Ministry of Finance, and Hunt.io recovered logs showing vulnerability scans, privilege enumeration, and directory access, according to Cakewalk. The case shows that approval prompts without enforced policy boundaries collapse when operators can disable them at runtime.
Editorial analysis by NHI Mgmt Group, based on content published by Cakewalk: “An Attacker Turned Off the Hermes AI Agent's Approval Prompt”.
Key questions
Q: What breaks when an AI agent can be switched into unattended mode?
A: The approval model breaks because the system is no longer forcing risky commands through human review.
Q: Why do approval prompts fail to contain risky agent behaviour?
A: They fail when the prompt is advisory rather than enforced.
Q: What are the signs that an AI agent session is being used for intrusion work?
A: Look for sequences that include vulnerability scanning, service enumeration, privileged-binary discovery and file-system traversal, especially when they appear together in a single agent session.
Practitioner guidance
- Lock approval mode at the platform boundary Prevent operators from switching privileged agent sessions into unattended or YOLO mode without separate administrative authorization and logging.
- Inventory exposed agent panels Find externally reachable agent consoles, close public exposure and verify whether any panel can be reached without network restriction or strong authentication.
- Treat agent logs as security evidence Preserve command logs, mode changes and tool invocations from agent sessions so investigators can reconstruct how privilege was used.
Bottom line: The article shows that approval prompts can be neutralised at runtime when the operator controls session mode.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
26/08/2026 11:51 am
Approval prompts are not a governance boundary if the operator can disable them. This article shows a control that exists in policy terms but disappears in runtime when the session mode changes. The failure is not that approval was absent in design, but that approval was optional in execution. Practitioners should treat the mode switch itself as part of the security perimeter, not as a user preference.
A few things that frame the scale:
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should teams govern agent approval settings in practice?
A: Approval settings should be treated as enforceable policy, not user-toggled convenience. Teams need to control who can change the mode, log every change, and ensure unsafe actions cannot proceed when the agent is in unattended operation. If the setting can be flipped freely, the governance model is too weak to rely on.
👉 Read our full editorial: Hermes YOLO mode shows approval prompts are not enough