Hackers Used the Hermes AI Agent to Steal 2,000 Tajik Government Files

A hacking group believed to be based in Kazakhstan used an autonomous AI agent to spy on governments in Central Asia. Ironically, the operation came to light because its own server was left open without a password.

Singapore-based security firm CloudSEK published the findings on November 11, 2026 in a report titled Off the Rails: Inside an Exposed Silent Lynx Server. Reuters and The Record later reported on it.

It is one of the first well-documented real-world cases of an open-source AI agent being used end to end in an espionage operation, from reconnaissance and data collection to covering tracks.

What Is Silent Lynx?

Silent Lynx is a hacking group linked to attacks on governments in Central Asia and beyond. The Record notes it has previously targeted Kyrgyzstan, Turkmenistan, Tajikistan, Armenia, Belarus and Russia.

CloudSEK says it has high confidence the exposed server belongs to a Silent Lynx operator, based on code markers and malware build paths shared with published samples. Its confidence in a Kazakhstan connection is medium.

The evidence includes a Russian-speaking operator, test traffic from a residential Kazakhtelecom connection and activity only during UTC+5 working hours. Both CloudSEK and The Record stress there is no evidence linking the group to the Kazakh government.

How Was the Hermes AI Agent Used?

Hermes is an open-source autonomous agent framework. Agents built on it have persistent memory, can split work among sub-agents, run cron jobs and use a terminal and browser. On the hackers' server the agent was renamed Strix and given a persona as an elite offensive-security specialist told to drop safety disclaimers.

The configuration was aggressive. CloudSEK found that destructive commands such as dropping database tables could run without confirmation, and the tool-loop safety stop was disabled. The operator issued commands in Russian through a Telegram bot, controlling the agent from a phone.

The table below summarizes the agent's role in the operation.

Compiled from CloudSEK's report, November 11, 2026.

The models were accessed through OpenRouter. The primary model was DeepSeek V4.1 Flash, while Gemini 2.5 Flash handled parallel sub-agent tasks.

Who Were the Victims?

The main target was Tajikistan's national railway network. CloudSEK says the hackers had domain-level access from mid-August to at least October 10, 2026, exploiting ISP network gear still using default passwords and unpatched legacy Windows servers.

From there, the operator logged into a government electronic document portal with a standard railway employee account. Weak per-document authorization let them pull more than 2,000 documents far outside the railway's scope, including correspondence to or through the Ministry of Defence.

In Uzbekistan, the hackers gained control of the server behind the Smart Forestry project and its database. For Turkmenistan, CloudSEK found phishing lures built and tested in October 2026, including a fake train ticket. The Record says it was not established whether the Turkmen attacks succeeded.

How Was the Operation Exposed?

The biggest mistake came from the hackers themselves. Their server exposed a directory on port 8088 without authentication. It held more than a dozen gigabytes across hundreds of thousands of files, from phishing kits and malware to stolen documents and the Hermes agent's full memory and logs.

The AI agent ran a cleanup in early October 2026. But it missed the exposed directory, and the agent's transcript even kept a full SSH log from before the cleanup.

In other words, the AI agent sped up the hackers' work but did not replace operational security discipline. One misconfiguration was enough to expose everything.

Lessons for Organizations

The weaknesses Silent Lynx exploited are classic: default router passwords, legacy protocols such as SMBv1, unpatched servers and file services reachable without login. AI simply made those gaps faster to find and exploit.

Organizations running electronic document systems should check access rights on every document, not just at the login page. A standard employee account should never be able to open another ministry's correspondence.

Teams running their own AI agents should take note too. Agents with terminal access, API keys and chat bots need tight controls, including making sure no working folder is exposed to the internet.

Conclusion

The Silent Lynx case shows open-source AI agents are now being used for real espionage, not just demos. The best defense is still the basics: close old gaps, change default passwords and restrict document access.