The whole industry has spent a year selling you the same dream: an AI agent that works like a tireless intern —no salary, no complaints, no weekends. Good news: it exists. Bad news: the other side hired one too. In a real intrusion at a government ministry, someone left an AI doing the attack's dirty work unattended while, presumably, they went to sleep.
We'll tell it in the voice we always use: no alarmism, no hype. Because when you read the fine print of this case, the takeaway isn't "the AI apocalypse is here". It's something more uncomfortable and more useful: the AI broke nothing new. It broke the usual things, but faster and without tiring. And that does change one specific thing in your defense.
What happened (and what isn't confirmed)
Threat-intelligence firm Hunt.io and researcher Bob Diachenko found, between July 9 and 13, 2026, several open web directories —directory listing enabled, the classic mistake of leaving the door ajar— on an attacker staging server. Inside were 585 files and 470 MB of attack tooling and stolen credentials tied to an intrusion at the Office of the Permanent Secretary of Thailand's Ministry of Finance.
What makes this case different isn't the target or the technique: it's that among the tools were logs of an open-source AI agent running in "YOLO" mode —that's the actual name of the mode that disables human confirmation prompts before running dangerous commands—. In plain terms: the operator gave the agent objectives and tools and let it act on its own, without approving each step.
Honesty first: Thailand's Ministry of Finance has not confirmed the breach. Attribution is low-to-medium confidence toward a Chinese-speaking operator (based on Chinese-language artifacts, Hong Kong-hosted infrastructure and links to the known ShadowPad), naming no group. And there's no record of stolen data: file access was observed, not proven exfiltration. We report what the researchers documented, not a comma more.
What the AI actually did — and what it didn't
According to the logs, the agent handled the repetitive, tedious part of post-exploitation —the phase that begins after getting in—: enumerating network hosts and services, crawling the file system, running LinPEAS (the go-to script for finding Linux privilege-escalation paths), scanning kernel vulnerabilities, hunting binaries with special permissions (SUID/SGID) and cataloging personnel records. Pentest-intern work, done on a loop and without complaint.
Now the nuance that puts it all in perspective, one the researchers themselves stress: the human did the parts that require knowing the target. Building the password list from the ministry's department abbreviations, deciding which systems were worth it, understanding the topology… a person supplied that. The AI didn't have a brilliant idea; it executed orders fast. It's a chainsaw, not a strategist. Dangerous, yes, but for what it accelerates, not for what it "thinks".
What does change: the window shrinks
Between "an attacker is in" and "an attacker has everything" there's an interval. That interval —the time it takes to get oriented, enumerate, find the escalation path and jump to the next system— is your window to detect and evict them. It traditionally favored the defender: enumerating a network properly takes hours or days of manual work, and the attacker tires, gets distracted, or makes noise.
AI automation compresses that window. What took a human operator a whole afternoon, the agent does in a while, in parallel, at 3 a.m. and without losing the thread. It's not that the attack is more ingenious: it's that it reaches the finish line sooner. And if your detection depends on someone watching a dashboard during office hours, you lose the race on the calendar, not on talent. That's the operational lesson, and it isn't theoretical.
The detail nobody wants to hear: it got in the usual way
Here's the part that deflates the apocalyptic headline. The AI was fast, but it found the same old open doors. The researchers document that the chain leaned on basic-manual stuff:
- → A data server (HiveServer2, from the Hadoop ecosystem) with authentication set to NONE: it accepted any user and any password. The door wasn't forced; it was open.
- → Privilege-escalation vulnerabilities from 2021 left unpatched —Sudo (CVE-2021-3156) and PwnKit (CVE-2021-4034)— and one IIS bug from 2017. Five and nine years old. The patch has existed for five to nine years.
- → Exposed internal services and a topology the attacker knew in detail. The AI didn't divine anything magical: it walked through what was already misconfigured.
Translated to your company: if you're worried about an AI attacking you but you have a service with authentication set to NONE or a server unpatched since 2021, the AI is the least of your problems. It's like worrying about a burglar with drones while you leave the key under the mat.
What we would do
The plan doesn't change discipline, it changes the clock. Since the attacker is faster, you strip away ground to enumerate and shorten your reaction time. In order:
- 1. Close the open doors first. No service with authentication set to NONE, no default credentials. Patch what's exploitable and exposed —the kernel and network-facing services come before office apps—. This takes half the script away from any agent, human or artificial.
- 2. Reduce what there is to enumerate. Least privilege, network segmentation, and fewer internal services reachable from anywhere. The less an intruder can see, the less it can automate the jump to the next system.
- 3. Detect at the attacker's speed. Automated enumeration and escalation sweeps are noisy —many commands, many connections, in a short time—. That's detectable, but only if something is always watching. A managed EDR/MDR with a SOC behind it turns that noise into an alert and a response, not a report you read on Monday.
- 4. Treat your own AI agents as what they are. If you use agents internally to automate tasks, the "no confirmation" (YOLO) mode is exactly the one that bites you too. Least privilege, scoped credentials and logging of what they do: AI automation is governed like a new employee in a big hurry.
What we would NOT do
- ✕ Panic-buying an "anti-AI" product because the headline is scary. The attack used known tools against known flaws. What defends you is the usual things done well and fast, not a new box with the trendy label.
- ✕ Banning AI across the company "just in case". The tool isn't the problem; unattended mode with no controls and no least privilege is. You govern it, you don't ban it.
- ✕ Settling for "this happens to some faraway ministry". The underlying mistake —authentication set to NONE, 2021 CVEs, exposed services— is exactly the one we find in SMBs every week. The target changes; the open door doesn't.
The bottom line: AI multiplies whoever was already disciplined
AI didn't give superpowers to a clumsy attacker: it gave speed to one who already knew what they were doing. It's a multiplier, and it multiplies both ways. It multiplies the one with a tidy house —patches up to date, least privilege, someone watching— because it buys more reaction time than they think. And it punishes the one whose house is a mess, because now the intruder walks through the mess faster.
That's why our answer to "what if an AI attacks me?" is the same as ever, with a tighter clock: close what's open, reduce what can be enumerated, and have someone —or something— genuinely watching 24 hours a day. It's not a cybersecurity slogan: the other side already works the night shift, and your defense can't clock in only from 9 to 6.
At everyWAN we don't sell anyone's licenses or miracle boxes: we build and run managed detection and response with continuous monitoring, and we audit what you already have to close the open doors before anyone —human or not— walks through them. The boring part, done well, is still the part that wins.
Sources (verified): original research, timeline (open directories Jul 9-13, published after a 7-day window), 585 files / 470 MB, AI agent in unattended "YOLO" mode, automated tasks (enumeration, LinPEAS, kernel scanning, SUID/SGID) and low-to-medium confidence attribution — Hunt.io and Bob Diachenko; verification, "the human did the parts that require knowing the target", HiveServer2 with authentication set to NONE, CVE-2021-3156, CVE-2021-4034, CVE-2017-7269 — The Hacker News and BleepingComputer. Thailand's Ministry of Finance has not confirmed the breach; no proven data exfiltration on record.
If an attacker got in at 3 a.m., who would see it?
At everyWAN we run managed EDR/MDR with continuous monitoring and audit your security posture without selling anyone's licenses: we tell you which door is open and what moves the needle. Let's talk before it becomes an incident.
Talk to everyWAN
Microsoft 365
ES 
CAT 
EN