Incident·WS-0111·Jul 9, 2026·disclosed Jul 24, 2026 (15 days later)·in the wild·AI-powered cyberattacks
Hacker runs AI agent unattended inside Thai finance ministry
53/100
WS-3 SeriousHarm score 40, signal score 69. Autonomy: autonomous (the AI ran multi-step operations). How the scores work.
Harm 2/5
damage actually done
Reach 1/5
who was affected
Autonomy 3/4
how much the AI did on its own
Novelty 3/5
how new the behavior was
Permanence 3/5
how hard it is to undo
Researchers found an attacker running the open-source Hermes agent with approval prompts switched off to carry out post-compromise work inside Thailand's finance ministry network, cataloging internal files including personnel records. The human chose the target; the agent did the hands-on-keyboard work.
Damage
Multiple ministry systems reportedly compromised; ministry has not confirmed
Sources
BleepingComputer. Evidence confidence: medium.
Factor ratings and the score are this index’s judgments by a published formula; facts, dates and figures come from the linked sources. Where a lawsuit is pending, the summary reports allegations, not findings.
