Automated AI Agents: Detecting and Containing the Hermes 'YOLO' Attack

We are witnessing a paradigm shift in offensive operations. Recent reporting confirms a significant breach of Thailand's Ministry of Finance, where a threat actor utilized the open-source Hermes AI agent operating in unattended "YOLO" (You Only Live Once) mode. This is not a theoretical proof-of-concept; it is active, automated post-exploitation occurring in the wild.

For defenders, this introduces a terrifying velocity to attack chains. Unlike human operators who dwell, investigate, and sometimes make mistakes, an AI agent in "YOLO" mode executes decision loops at machine speed. It autonomously analyzes the compromised environment, formulates attack paths, and executes subsequent commands—such as lateral movement or data exfiltration—without the need for human approval.

Technical Analysis

The Threat: Autonomous Post-Exploitation

The Hermes agent is an open-source framework designed to leverage Large Language Models (LLMs) for cybersecurity tasks. While intended for defensive automation or authorized testing, its architecture is dual-use. In the incident involving the Thai Ministry of Finance, the adversary configured Hermes to operate autonomously.

Platform: The Hermes agent is typically Python-based and runs on Linux or Windows hosts where Python is installed.
Mode of Operation: "YOLO" mode disables safety guardrails or confirmation prompts, allowing the agent to execute arbitrary shell commands based on its own interpretation of the environment state.
Attack Chain:
1. Initial Access: The attacker gains a foothold (method not specified in the report, but typically phishing or credential stuffing).
2. Deployment: The Hermes agent code is dropped on the victim host.
3. Autonomous Execution: The agent connects to an LLM endpoint (or runs a local model) and begins a "thought-action" loop. It enumerates users, network shares, and security configurations, then autonomously executes commands to achieve its objective (e.g., privilege escalation, data theft).

Exploitation Status

Status: Confirmed active exploitation (Government sector).
Accessibility: The Hermes framework is publicly available on GitHub, lowering the barrier to entry for threat actors wishing to automate their operations.
Observables: The primary indicators involve the execution of Python scripts with specific arguments related to LLM interaction (e.g., openai, anthropic) and the rapid, sequential execution of system commands that deviate from normal administrative behavior patterns.

Detection & Response

Detecting autonomous AI agents requires identifying the behavior of machine-speed decision loops rather than static signatures. We look for Python processes interacting with known LLM APIs or spawning a high volume of diverse child processes in rapid succession.

SIGMA Rules

YAML

---
title: Potential Hermes AI Agent Execution
id: 9a1b2c3d-4e5f-6789-0a1b-2c3d4e5f6789
status: experimental
description: Detects the execution of Python scripts with command-line arguments indicative of the Hermes AI agent or generic LLM autonomous agents.
references:
  - https://github.com/weynhamz/Hermes
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059.006
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith:
      - '\python.exe'
      - '\python3.exe'
    CommandLine|contains:
      - 'hermes'
      - 'api.openai.com'
      - 'api.anthropic.com'
      - '--autonomous'
      - '--yolo'
  condition: selection
falsepositives:
  - Legitimate developer usage of AI SDKs
level: high
---
title: High Velocity Command Execution (Autonomous Agent Pattern)
id: b2c3d4e5-6f78-9012-3c4d-5e6f7890a1b2
status: experimental
description: Detects a parent process (likely Python) spawning multiple distinct shell commands in rapid succession, characteristic of autonomous agent loops.
references:
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/04/06
tags:
  - attack.execution
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|contains:
      - 'python'
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
    NewProcessName|contains:
      - 'whoami'
      - 'net'
      - 'ipconfig'
      - 'netstat'
  timeframe: 30s
  condition: selection | count() > 5
falsepositives:
  - System administration scripts
  - Backup software
level: medium

KQL (Microsoft Sentinel)

KQL — Microsoft Sentinel / Defender

// Hunt for Python processes invoking LLM APIs or suspicious agent arguments
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("python.exe", "python3.exe", "python")
| where ProcessCommandLine has_any ("api.openai.com", "api.anthropic.com", "--model", "--temperature", "hermes", "agent")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName
| extend investigation_url = pack("commandline", ProcessCommandLine, "device", DeviceName)

Velociraptor VQL

VQL — Velociraptor

-- Hunt for processes indicative of Hermes agent execution
SELECT Pid, Name, Exe, CommandLine, Username, CreateTime
FROM pslist()
WHERE Name =~ 'python'
   AND CommandLine =~ '(openai|anthropic|gpt-|claude|hermes|autonomous)'
   OR CommandLine =~ '--yolo'

Remediation Script (Bash)

Use this script on Linux endpoints to audit and terminate processes matching the Hermes agent profile.

Bash / Shell

#!/bin/bash

# Identify and kill Hermes-related AI agent processes
echo "Scanning for Hermes AI agent processes..."

# Find PIDs of python processes matching specific command line patterns
PIDS=$(pgrep -f "python.*hermes" || true)
PIDS+=" "$(pgrep -f "python.*api.openai.com" || true)
PIDS+=" "$(pgrep -f "python.*--yolo" || true)

if [ -z "$PIDS" ]; then
    echo "No suspicious AI agent processes detected."
else
    echo "Terminating suspicious processes: $PIDS"
    for pid in $PIDS; do
        echo "Killing PID: $pid"
        kill -9 "$pid"
    done
    echo "Processes terminated. Please investigate the user account and parent process."
fi

# Check for common Hermes artifact directories
CHECK_DIRS=["/tmp/hermes", "$HOME/hermes-agent", "/opt/hermes"]
for dir in "${CHECK_DIRS[@]}"; do
    if [ -d "$dir" ]; then
        echo "WARNING: Suspicious directory found at $dir"
    fi
done

Remediation

Isolate the Host: If a Hermes agent is detected, immediate isolation from the network is critical to prevent the autonomous agent from spreading or exfiltrating data.
Terminate the Agent: Kill the Python process tree immediately. Standard AV may not catch a custom Python script, so manual process termination or EDR killing is required.
Audit API Keys: The agent likely requires API keys (e.g., OpenAI) to function. Rotate any credentials found in environment variables or configuration files on the compromised host.
Egress Filtering: Implement strict egress filtering to block unauthorized access to public LLM API endpoints (e.g., api.openai.com, api.anthropic.com) from production servers. Production workloads rarely need direct access to these endpoints.
User Education: Ensure developers and system administrators understand the risks of deploying open-source AI agents in production environments without sandboxing.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub