An attacker ran an AI agent in YOLO mode. Devs do too.

Someone breaking into a government ministry made the same configuration choice your developers make on a Tuesday afternoon: they turned off the approval prompts. Researchers recovered the agent's logs, and the result is an unusually clear look at what an AI agent approval gate is actually holding back — because in this case, nothing was.

What actually happened

Hunt.io, working with researcher Bob Diachenko, found three publicly accessible directories on a Hong Kong-hosted server, exposed between July 9 and July 13, 2026. They held 585 files, about 470 MB of exploit code, web shells, tunneling tools, stolen credentials, session material, and a previously undocumented Go implant the operator called Hades — built for both Windows and Linux, with interactive shells, persistence, SOCKS proxying, and HTTPS command-and-control using URI paths shaped to look like ordinary traffic. The target was Thailand's Ministry of Finance. Thailand's national CERT and NCSA were notified on July 15 and acknowledged the same day; the ministry has not confirmed a breach.

The part worth your attention is how the operator worked. They delegated the tedious middle of the intrusion to Hermes, an open-source autonomous agent released in February 2026 that runs as a persistent daemon and carries memory across sessions. Hunt.io's finding is blunt: the logs "show the operator ran the agent in unattended or YOLO mode, bypassing approval prompts for commands that could be considered dangerous." With approvals off, the agent enumerated hosts, hunted privilege escalation paths, ran LinPEAS, scanned for kernel vulnerabilities and SUID binaries, inspected containers, and recursively catalogued ministry web directories.

Why the AI agent approval gate matters for your business

Skip the hacker framing for a second, because the operational lesson is about your agents.

That toggle is in your tools. Every serious coding and ops agent ships an approval prompt and a flag to skip it, and the flag is genuinely tempting — approvals are friction, and a long-running job that stops to ask is a job you have to babysit. The attacker's calculation was identical to yours. They decided supervision cost more than it was worth. The difference is that when your agent gets the scope wrong, the blast lands on your production database instead of somebody else's ministry.

Treat the gate as the control surface, not a nag. Approvals off is defensible on a scratch branch in a throwaway container; it is not defensible anywhere holding customer data, credentials, or deploy rights. Scope what the agent can reach before you decide how much to trust it — an agent with read-only credentials in an isolated environment barely needs a gate, which is the actual goal.

And note the second half of this story: the agent's own persistent memory and verbose logs are what let researchers reconstruct the entire operation. Agents write down everything they do. That is a gift when you're auditing your own automation, and a liability wherever those logs land.

Sources: Hunt.io, BleepingComputer.