Hermes Agent AI framework used for autonomous cyber attacks

Palo Alto Networks’ Unit 42 reported that a Chinese‑language attacker leveraged the open‑source Hermes Agent framework together with the DeepSeek language model to conduct autonomous cyber attacks. After a brief instruction via Telegram, the agent independently scanned the Internet, identified exposed systems and selected public exploits, lowering the barrier for rapid intrusion attempts. The incident highlights a new threat vector for organizations that expose services online, especially in the DACH region, and underscores the need for stronger hardening of remote access points.

Hermes Agent, developed by Nous Research, has become a widely adopted AI‑agent platform, attracting over 214 000 GitHub stars and a valuation of $1.5 billion. Recent analyses indicate that the framework has already been abused, with reports of 460 systems compromised through Hermes‑related exploits. The growing popularity of the tool, combined with its advanced capabilities for autonomous task execution, raises significant security concerns for enterprises and public‑sector entities alike.