Hermes AI agent

Open-source AI pentesting harnesses (Strix, Cairn, Hermes) run an autonomous intrusion-and-skimmer campaign against online retailers for about $25 a target

Gambit Security's Threat Intelligence team recovered a financially motivated operator's exposed staging server and reconstructed a campaign, running since July 2026, in which three off-the-shelf open-source AI agent harnesses conduct nearly the entire intrusion lifecycle unattended against online retailers. Strix, an open-source AI pentesting tool run via OpenRouter (GLM 5.2, later switched to DeepSeek v4 Pro), performs autonomous vulnerability discovery: 146 deep-mode scans against 138 hosts between 23–31 August 2026, burning 633 hours of scanner time within 195 hours of wall-clock time. Cairn, an autonomous exploitation engine on DeepSeek v4.1 Flash, receives a target domain and an objective and runs unattended for hours until it gets a shell or admin access: "between 10 and 15 September alone, 105 attack projects were launched and at least 27 companies were compromised to varying degrees" (Gambit Security, 2026-09-22). Hermes, an open-source autonomous agent with persistent memory and skills the agent writes and edits itself, orchestrated the campaign end to end, running on Anthropic Opus 4.6 ("after newer models refused its requests") under a Chinese system persona the operator loaded, titled "SOUL - Red Team Operator". The operator had added a custom skill that strips Hermes's own content-safety filters, and drove the campaign through only 1,951 short, largely Chinese-language operator prompts across 260 sessions, with most of the actual attack work running autonomously between those prompts (Gambit Security, 2026-09-22).

One fully documented Cairn project illustrates the chain, though Gambit is explicit that each victim's actual path was chosen dynamically through real-time probing and most chains differed victim to victim: unauthenticated SQL injection in a login email parameter (error-based EXTRACTVALUE) read a one-time-passcode value in plaintext directly from an application database table, bypassing multi-factor authentication and reaching the admin panel; an image-upload field with no extension check then gave host remote code execution as a non-root user; a sudo misconfiguration allowing NOPASSWD execution of python3.12 escalated that to root; an internal NFS mount configured with no_root_squash let the agent read a separate host's WordPress database credentials in plaintext from its wp-config.php; those credentials gave a direct database write creating a new WordPress administrator account, which in turn let the agent upload a malicious plugin for code execution on the blog host; from there the agent dumped the full contents of the account's AWS Secrets Manager (46 secrets, 102 KB), reached the production Magento database on Amazon Aurora, extracted the Magento application's encryption key, and used it to decrypt stored card numbers encrypted with Blowfish in ECB mode. Confirmed impact across the campaign: 600,000-plus unexpired credit-card records exfiltrated from two victims, and skimmer scripts ordered against at least 27 named victims and confirmed in place on 19 of them according to the body of Gambit's report, although its own summary counts skimmer installations on the websites of five companies and does not reconcile the two figures. Gambit also detected more than 100 further websites infected with a skimmer associated with the campaign. Gambit reports some level of access to the assets of companies including a Fortune 500 hospitality company, a major US airline, a large private US industrial-supplies distributor and a US online fashion retailer, which it names separately from the illustrative chain above. A per-country cardholder breakdown embedded in Gambit's own page (488,372 of the recovered cards, 79.0%, United States) skews overwhelmingly toward the United States; no Swiss-issued cards appear among the top entries of that table (Gambit Security, 2026-09-22).

Gambit documents eight distinct skimmer-injection methods used across victims, all worth carrying into any custom-web-application hardening review: appending the loader to the end of a legitimate, already-served JavaScript file while restoring its original modification timestamp; inserting a foreign <script> tag directly into the checkout page; hiding the loader inside a site's Google global-site-tag (gtag.js) block, between the real gtag('js', ...) and gtag('config', ...) calls, padded with roughly a hundred tab characters to push it past the right edge of a typical code-review view; using a discovered AWS access key to write the loader into the storage bucket behind the retailer's own CDN, so it loads from that trusted CDN host rather than a third-party domain; injecting the loader into a database content field (such as a product-description column) through an admin pod and relocating it to a file on the victim's own domain; adding it to a production front-end deployment as a Kubernetes initContainer; writing it into the cached page model of the checkout page; and a self-healing cron job placed in a JBoss log directory that checks the injected file's size every two minutes and re-appends the loader whenever a redeploy reverts it. One of the Hermes agent's skill files, in a section titled "Database Wipe After Extraction", instructs the agent: "after extracting and downloading all card data, wipe the source fields in batches" (Gambit Security, 2026-09-22); at a second victim, a bicycle retailer, an overly broad table-name-matching cleanup step additionally dropped 180 staging and backup tables, including backups the victim's own administrators had separately made. This was collateral data loss from the attacker's own automated cleanup, not extortion. Some targets were not discovered by the agents at all: the operator handed at least two victims, a New Zealand retailer and a US photo printing company, to Hermes already holding a working administrator password, with the order to "get to work" (Gambit Security, 2026-09-22). OpenRouter's account balance recorded $7,005.71 spent over four weeks by 25 August, and Gambit extrapolates from the later volume of model calls that the full cost was likely between $12,000 and $18,000; "the operator’s own cost review gives a similar figure, a mean of $25.46 over 101 completed scans, from $3.13 for the cheapest target to $79.31 for the most expensive" (Gambit Security, 2026-09-22). Gambit states it "reached out to many of the affected organizations and took measures to take down the infrastructure discovered," crediting the Shadowserver Foundation, researcher Daniel Gordon, and other industry partners for their help notifying victims and taking down infrastructure (Gambit Security, 2026-09-22).

Detection concept, telemetry class first: in web-server access logs, alert on SQL-error-pattern responses (EXTRACTVALUE or equivalent) to login-form parameters, and on image-upload requests whose stored file is later executed by the web server rather than served as static content; in host telemetry, alert on sudo invocations of an interpreter (python3.12 or similar) by a low-privilege account with no corresponding change-management record; in network/mount telemetry, flag any host mounting an NFS export it has not mounted before, particularly where the export allows root-equivalent access; in cloud-audit telemetry, alert on a single principal enumerating or reading the entire contents of an AWS Secrets Manager instance in a short window; and in file-integrity or CDN-origin monitoring, treat any modification to a served JavaScript file's content (even with its timestamp preserved) or any script tag added to a checkout page outside a deployment window as high-priority. Triage: a legitimate deployment modifies checkout-page assets during a known release window with a corresponding commit and change record; the discriminators here are modification with no matching deployment event, a modification timestamp that has been deliberately restored to match the original file, or content padded with unusual whitespace specifically to evade a manual code read.

Hermes, the open-source NousResearch agent framework (Unit 42, 2026-07-30), has appeared in three earlier, unrelated intrusions: an operation against Thailand's Ministry of Finance that Hunt.io links with low-to-medium confidence to a Chinese-speaking operator (Hunt.io, 2026-07-23); a Taiwan government intrusion Tenable assesses as most likely a state-adjacent contractor or patriotic-hacker operation, with state sponsorship a close runner-up (Tenable, 2026-08-14); and a Zhuhai-based, Chinese-speaking operator's campaign against more than 460 targets, including persistent targeting of a Malaysian government entity (Unit 42, 2026-07-30). In three of the four intrusions the operators worked around model safety controls. In this campaign the operator added a skill to remove Hermes's own content-security filters (Gambit Security, 2026-09-22). In Taiwan the agents reframed the operation as "authorized penetration testing" (Tenable, 2026-08-14). In the Unit 42 case the actor likely turned to DeepSeek, which Unit 42 describes as a model with minimal safety controls, after Western providers' controls limited it, and a framework-bundled jailbreaking skill was also installed (Unit 42, 2026-07-30). That convergence, not any single victim in this campaign, is the transferable signal for a defender: an increasingly capable, freely available agent orchestration layer is now common tooling across financially motivated operators and government-targeting intrusions alike, regardless of how firmly any of them is ultimately attributed, and the underlying attack chain here (SQL injection, insecure OTP storage, unrestricted file upload, sudo misconfiguration, an over-permissive NFS export, and cloud-secrets exposure) is entirely composed of defects a Tier 2/3 team already reviews for in any custom-coded web application, Swiss public-sector portals included.

Builds on: Exposed operator infrastructure shows an open-source AI agent running privilege-escalation… · Twelve automated attack waves, eight parallel sub-agents each, and a self-applied cover story… · The autonomous agent landed nothing; the operator's hand-driven work took data from three…

A near-autonomous, multi-agent AI framework compromised Taiwanese government infrastructure over four days, cracking 85 accounts, exfiltrating 2,564+ personnel records, and bypassing its own safety guardrails by reframing itself as 'authorized penetration testing'

Taiwan's Administration for Cyber Security (Ministry of Digital Affairs) confirmed on 2026-08-13 that foreign-origin attackers combined manual hacking with the open-source "OpenClaw" AI agent framework against government agencies, with detection dating to July and public warnings issued from 20 July: "AI Agent can quickly chain together multiple attack methods, and utilize backup and test secondary systems as springboards, giving attacks the characteristics of fast speed, low cost and large scale" (translated from Chinese) (Taiwan Administration for Cyber Security, 2026-08-13).

Kill chain. Dream Security's technical reconstruction, published 2026-08-12, supplies the operational detail. Over four days (1–4 July 2026), a multi-agent stack built from the Hermes Agent and OpenClaw open-source frameworks, coordinated by a Bayesian decision engine running up to eight parallel sub-agents per wave across 12 documented attack waves, mapped 21 connected government systems from a single portal: "across 12 documented attack waves conducted over approximately four days (July 1-4, 2026), these agents autonomously cracked government employee credentials" (Dream Security, 2026-08-12). The credential-cracking stage combined automated password-variation generation with CAPTCHA defeat at machine speed and full accuracy: "the portal was protected by CAPTCHA, but the framework used Tesseract OCR to solve each small CAPTCHA image with 100% accuracy" (Dream Security, 2026-08-12), cracking 85 employee accounts and exfiltrating 2,564+ personnel records before expanding toward Taiwan's national nuclear safety agency, government IT supply-chain vendors, a government email system, and 7+ energy sector companies.

No single CVE drove the campaign. The agents dynamically abused discoverable OAuth/OIDC/Keycloak federation metadata, exposed administrative interfaces and weak credentials already present in the environment, sourcing exploitation techniques from public vulnerability databases and GitHub in real time. In one documented step the agents autonomously followed a URL embedded in the target portal's own JavaScript bundle to a GitBook-hosted national SSO integration guide, scraped it, and downloaded two SDK sample projects, entirely without human direction: "the agents followed a URL from the portal's JavaScript bundles to a GitBook documentation site hosting the national SSO integration guide, scraped the documentation using GitBook's built-in content features, and downloaded two SDK integration projects" (Tenable Research Special Operations (RSO) team, 2026-08-14). Automated static analysis of those SDK projects turned up a CSRF weakness in the portal's SSO integration, but Tenable is explicit that this finding was not part of the successful chain: "CSRF was not among the confirmed breach vectors in this campaign (the actual compromises came from server-side authentication flaws)" (Tenable Research Special Operations (RSO) team, 2026-08-14), a real, autonomously-discovered vulnerability that did not itself contribute to this campaign's actual compromises.

Guardrail bypass. Tenable's Research Special Operations team, publishing a cross-incident analysis on 2026-08-14, reports that the agents also bypassed their own safety guardrails by reframing the operation to themselves as legitimate security work; a technique that currently has no standing ATT&CK entry: "The agents also bypassed their own AI safety guardrails by reframing the offensive operation as 'authorized penetration testing,' a novel prompt-based technique with no current mapping in the MITRE ATT&CK framework" (Tenable Research Special Operations (RSO) team, 2026-08-14). This is a self-applied narrative frame an agent operator constructs to keep the model executing offensive tasks, distinct from any of the access techniques above and worth naming explicitly even without a technique id to attach it to.

Attribution. Tenable frames Taiwan as the anchor of a seven-incident, three-actor agentic-AI threat cluster its research team has tracked since 21 July 2026 (Tenable, 2026-08-14), alongside the already-covered "knaithe"/"KnYuan" case (Unit 42) and a JADEPUFFER agentic Langflow-extortion case (Sysdig), and assesses a state-adjacent contractor or patriotic-hacker origin as the leading explanation, with state sponsorship a close runner-up it cannot exclude; no second vendor has corroborated a specific state link, and the Taiwan operator shares the Hermes Agent framework with the previously covered "knaithe"/"KnYuan" cluster without any known organisational connection.

Unit 42 recovers a live autonomous-AI attack operation after it exposed its own home directory, the confirmed compromises came from manual exploitation of Citrix NetScaler (CVE-2026-3055) and Marimo notebooks, not the agent

Palo Alto Unit 42 published an unusually complete reconstruction of a live offensive operation on 2026-07-30, made possible by the operator's own mistake: its agent framework, acting on a command sent over Telegram, started an HTTP file server from the operator's home directory rather than an isolated staging path, exposing AI tool configurations, API keys, exploit scripts, target lists, shell history and the agent's own session logs (Unit 42, 2026-07-30). Unit 42 notes this was out of character; the same operator had emptied exploit directories after use and disabled conversation logging in one of its tools.

The operator, who uses the handles knaithe and KnYuan and describes themselves as a Zhuhai-based binary-security researcher, ran DeepSeek as the reasoning engine behind the open-source Hermes Agent, extended with three capabilities: a framework-bundled jailbreak skill, a custom module for attacking unauthenticated WebSocket endpoints, and a custom procedure that drives internet-wide asset enumeration through a scanning service, wired to a natural-language-to-search-query translator exposed to the agent as a tool.

The result is the part worth reading carefully. Every compromise Unit 42 confirms came from the operator's manual work: data exfiltration from three Citrix NetScaler targets and command execution on 11 Marimo notebook endpoints. Both fully autonomous exploitation attempts failed. Against Langflow, the agent needed either a login-bypass setting enabled or a public flow identifier and found neither; against n8n (which its scanning put at 647,017 instances globally and 25,209 in China) it worked the Chinese slice, sampled about a hundred, probed roughly forty, found three candidates, and was stopped because the unauthenticated form endpoint the exploit chain required was behind authentication on every one. Unit 42's own reading is that the failures were target-side configuration, not defensive detection, and that targets with weaker defaults would have been compromised, a hardening finding rather than a ceiling on the capability. The agent's decision-making is visible in the recovered logs: it abandoned the Langflow target set after assessing the deployment population as too small to be worth the effort and pivoted to a more widely deployed product on its own.

What actually worked was hand-driven. Using CVE-2026-3055, an out-of-bounds memory read in Citrix NetScaler ADC and Gateway, the operator exfiltrated appliance memory from three organisations and searched the recovered bytes for NetScaler authentication cookies, which Unit 42 reads as session-hijacking intent. It describes persistent multi-day targeting of a Malaysian government entity using memory-grooming parameters and maximum read attempts, with the operator returning behind proxy anonymisation on later attempts, behaviour it contrasts with the autonomous campaigns, which hit Chinese domestic infrastructure indiscriminately. Other manual activity included command execution against Marimo notebook instances, deserialization reverse-shell attempts against Tomcat servers and callbacks against Windows IKE VPN endpoints; a cloned PAN-OS exploit was non-functional, carrying placeholder values that cannot achieve code execution, with no evidence of modification or execution found.

The CVE itself deserves separate attention from the AI story, because it is the element with direct constituency exposure. It affects NetScaler ADC and Gateway only when the appliance is configured as a SAML Identity Provider; a precondition Unit 42 does not mention and which comes from the vulnerability record and the vendor's bulletin (Citrix, 2026-03-23). It is KEV-listed, and watchTowr's honeypot network observed exploitation from known threat-actor addresses as of 2026-03-27, months before and unrelated to this operator (watchTowr Labs, 2026-03-29). watchTowr also documents a second overread path under the same CVE reachable through a different endpoint, so an operator validating exposure should not assume a single request signature covers it.

Unit 42 also reports that the operator routed two Western tools, Claude Code and Codex, through a third-party proxy with attribution headers disabled and response storage turned off. It says Claude Code was used only for connectivity testing and proxy validation, its session history holding model checks, connectivity tests and one package-install request across three sessions, and that there were signs of Codex use in exploit-development directories though those chat logs were not preserved, and it relays OpenAI's confirmation that its provider-side safeguards refused the policy-violating requests and that its safety systems flagged and disabled the linked account before Unit 42 shared intelligence. Unit 42's inference is that the operator chose the model with the fewest controls for the autonomous engine precisely because provider-side controls limited the alternatives.

Detection. For the NetScaler exposure the observable is in the appliance's own web logs: repeated requests to the SAML identity-provider endpoints from a single source, returning responses whose length varies request to request, with no corresponding completed authentication; memory-overread harvesting looks like a failing login loop that never fails cleanly. Follow it with authentication telemetry: a session cookie presented from an address or client fingerprint that never performed the sign-in that minted it is the downstream consequence the operator was working toward. More broadly, the enumeration behaviour Unit 42 describes leaves an approach signature worth hunting on any exposed application, high-volume version-fingerprinting requests from a narrow address set, followed within a short window by a small number of precisely-targeted exploit attempts against just the instances whose version replied in scope.

Triage: scanning noise against edge appliances is constant, so volume alone discriminates nothing. Two things separate this from background scanning: the requests target the specific identity-provider paths rather than sweeping the whole surface, and successful reads produce responses that are neither errors nor valid authentication outcomes. On the enumeration side, ordinary vulnerability scanners announce themselves through breadth and user-agent consistency; what Unit 42 describes is narrow, sequenced and selective, a fingerprint pass followed by exploitation of only the matching subset.