Hermes AI agent ran a spy op. Its exposed server leaked it.

A spy crew handed its hacking job to an open-source AI agent, then left the agent's server open to the internet. That is how researchers at CloudSEK found a Kazakhstan-linked group using the Hermes AI agent to steal more than 2,000 national-security documents from Tajikistan, Reuters reported on November 11. There are two lessons here, and the second one applies to anyone running an agent.

What actually happened

From CloudSEK's report, as carried by Reuters:

• The tool: Hermes, an open-source framework for autonomous AI agents. (Nous Research builds Hermes Agent; it is not accused of anything.)
• The timeline: reconnaissance started around mid-August. About two weeks later the group was inside Tajikistan's electronic document system.
• The agent's job: it planned the attacks, wrote and ran the tooling, kept notes and wrote reports. It also wrote a custom program to download the files, sort them and split them into chunks to move out.
• The mistake: the operators left a server exposed online. CloudSEK recovered the instructions they gave the agent, including a system prompt casting it as "an elite offensive security specialist and red teamer."
• The attribution: CloudSEK ties the work to a group called Silent Lynx, citing Russian-language messages, Kazakh business hours and a residential Kazakh internet connection. Kazakh and Tajik officials did not respond to Reuters.

Why it matters for your business

Lesson one: the attacker's labor cost just fell. Recon, custom scripts and sorting stolen files used to take skilled people's time. An agent did that work here. Expect more attacks against smaller targets, and shorter gaps between a public bug and an attempt on it. Your patch window is shorter than it was last year.

Lesson two: the agent server is the crown jewel. The attackers' whole playbook leaked because one box was reachable. Your AI agent setup has the same parts: system prompts, memory, logs, and API keys for every tool it can touch. If that server or dashboard is exposed, anyone can read how your business runs and use those keys.

What we check on every agent we deploy:

1. No public dashboard. Agent UIs and gateways sit behind login or a private network. Never a bare port.
2. Scoped keys. Each tool key gets the least access it needs, with a spend cap.
3. Logs treated like customer data. Agent transcripts hold customer data. Encrypt them, retain them on purpose, and restrict who can read them.

Sources: Reuters, AKIpress (Reuters report).