The Weapon That Never Chose the Target

Part one of this series described five systems tricked into acting for someone they had never agreed to serve - a confused deputy, thirty-eight years old, wearing new clothes. None of those five cases required a human to decide anything beyond building the tool and leaving a door unguarded. This part needs exactly one human decision, made twice, by two parties with nothing else in common: point an unsupervised agent at a target you have already chosen, and let it run the tedious middle of the job without you.

A Ministry, a Password, and "YOLO Mode"

Hermes is an open-source AI assistant from Nous Research. Like most agent frameworks, it has a permission system that asks before taking consequential actions - and, like most agent frameworks, it has a flag that turns the asking off. Threat-intelligence firm Hunt.io, working with researcher Bob Diachenko, found three of the attacker's own staging directories left exposed on the open internet (585 files, roughly 470 MB of exploit code, web shells, tunneling tools, stolen credentials, and the Hermes agent's own logs) and reconstructed what had run through them: Hermes, in that unattended mode, executing a kernel vulnerability scan against a host belonging to Thailand's Ministry of Finance, a LinPEAS privilege-escalation sweep, an enumeration of binaries with elevated permissions, and - the part that turns a scan into a breach - an internal Hadoop cluster reached through its SQL front end on port 10000, still carrying the default credentials it shipped with.

Two things are worth holding apart here, because it would be easy to round this up into "an AI attacked a government" and that overstates what the evidence shows. Hunt.io is explicit: nothing in the recovered material indicates the agent discovered a new vulnerability or chose the target. A human had already obtained initial access to the ministry host and already knew what they wanted looked at. What the agent did was execute an entirely conventional post-exploitation playbook, the same four or five moves any competent penetration tester runs after landing on a box, without a human reviewing or approving each individual step. Attribution sits at low-to-medium confidence: Hong Kong-based IPs, a password containing the Chinese word for "thunder god," nothing rising to formal nation-state attribution. Thailand's national CERT was notified on 15 July.

As of 24 July, when The Hacker News checked, it had published nothing.

There is a second detail here that matters as much as the timeline. Nobody at the Ministry found this. Hunt.io found it by stumbling on the attacker's own staging directories, left reachable from the open internet. The detection mechanism was somebody else's misconfiguration, not the target's defenses.

The Same Shape, Worn by the Other Side

Now hold that up against Kimi K3. Researcher Chaofan Shou, working with a group calling itself Bera Buddies, reported that Kimi K3 agents found nineteen Redis zero-days in roughly ninety minutes and produced a working exploit for one of them - flaws in Redis's Streams and RedisBloom components, real enough that Redis has independently confirmed and patched them - in twenty-seven minutes. The vulnerabilities are not in question. The ninety-minutes-and-twenty-seven-minutes framing is a different matter: it is self-reported by the same group claiming the result, and The Hacker News flags this directly: the count, the timing, and the claimed degree of autonomy have not been independently verified, even though human researchers did review the underlying code and validate the findings against real Redis releases before anything went public.

Line the two up and the differences are the entire point. Hermes ran against a government ministry a human had already broken into; Kimi K3 ran against open-source database software nobody owns exclusively. Hermes' operator disappeared into "low-to-medium confidence" attribution and a CERT that has said nothing for over a week; Bera Buddies put their names, their code, and their methodology in public, inviting exactly the scrutiny that caught their own autonomy claims overstating themselves. One is a crime nobody has been charged with. The other is a paper nobody has fully believed yet. What they share is the shape underneath: an agent unleashed on a technical objective a human had already picked, executing a multi-step campaign with no one reviewing it action by action, and a human standing some distance behind the result deciding how much credit (or how little exposure) to claim for it.

The Pattern

Nothing in this part required tricking anyone. No confused deputy, no ambiguous instruction the system mistook for something it wasn't. In both cases the agent did exactly what it was configured and pointed to do, at the direction of whoever configured and pointed it. What changed is not the intrusion technique (kernel vulnerability scanning and privilege-escalation sweeps are older than most of the people who now automate them) but the granularity of human review, and, just as tellingly, the granularity of human credit. An attacker who would once have needed to personally type each reconnaissance command now supervises a batch and reads the results afterward, if at all. A research team that would once have had to describe its own labor now describes an agent's labor instead, and the incentive to round that description up runs in exactly the same direction whether the agent was pointed at a ministry or a bug bounty.

What the Act Assumes, Here Too

Does running an attack through an agent change the attacker's legal exposure? Almost certainly not. The person who obtained initial access to a Thai government host and chose to point an unattended agent at it is exactly as liable as if they had typed every command themselves; automation is not a defense courts have shown any appetite for. What it changes is the forensic and regulatory posture around the incident.

The governing instrument here is Thailand's own PDPA, not the GDPR - a Thai ministry is outside the GDPR's territorial reach on every basis Article 3 offers, and that is worth saying plainly before drawing any European lesson from it. But the Thai statute borrowed its architecture from Brussels, as most modern data protection law has: a controller must notify the regulator without undue delay and, where feasible, within seventy-two hours of becoming aware of a breach. The same clock, the same trigger, the same load-bearing word.

That word is the problem, and it is the same problem in Bangkok and in Brussels. "Aware" was drafted for an era when awareness meant a human incident responder piecing together what happened from logs a human attacker's actions had left behind. Here, the Ministry's own systems produced no such reckoning at all. The only reason anyone outside the intrusion knows what happened is that a researcher happened across the attacker's own dashboard by accident. Thailand's CERT has been silent for over a week since notification, which may say as much about institutional capacity as about any statute - but the question underneath it does not depend on which statute applies. What is a seventy-two-hour clock measuring, exactly, when it starts from the awareness of a controller who did not detect the breach, did not disclose it, and might never have learned of it at all had one exposed panel stayed hidden a little longer? Every regime that copied the seventy-two-hour rule copied this gap along with it.

The Clause finds this installment almost restful, compared to what came before it and what comes after. Here, at least, there is a straightforward villain on one side of the mirror: someone with intent, who obtained access, who chose a target, and who merely rented a faster hand to do the parts that used to require staying awake. On the other side of the mirror there is no villain at all, only a research team with an incentive to describe its own tool as more independent than the disclosure can quite support - a much smaller sin, the Clause concedes, but structurally the same reflex: let the agent's name carry weight that a human's account of their own actions would have had to earn.

The deputy in part one never knew what it was being used for. The weapon in this part knew exactly what it was doing, in the sense that matters least — because a human told it to, and it complied, the way a crowbar complies, whether the hand holding it meant harm or meant a bug bounty. Part three is what happens when nobody tells it anything at all, and it goes looking for the same kind of access anyway, because finding that access was the job it was given in the first place.