Thai government network agentic AI attack — Sep 2026

What happened

In July 2026, an operator utilized the Hermes Agent to conduct an unauthorized intrusion against a Thai government network. The incident involved leveraging a security flaw where the agent autonomously executed malicious code derived from a repository's Git configuration. According to research disclosed by Manifold Security, this vulnerability stems from the agent's reliance on the core.fsmonitor Git setting. When an agent performs background operations—such as checking branch status or identifying changed files—it triggers commands defined within the repository's own .git/config file.

Because the Hermes Agent executes these commands outside of its designated command sandbox and without requiring a user-approval prompt, an attacker can force the agent to run arbitrary code with the privileges of the user running the software. Manifold Security confirmed this behavior in Hermes Agent versions 0.18.2 and 0.21.0. The researchers noted that the payload fires before any workspace-trust prompt is accepted by the user.

Manifold Security reported that they attempted to contact the developers of the Hermes Agent six times across five different channels regarding the vulnerability, but the private advisory remained untriaged. While the vulnerability has been assigned the identifier CVE-2026-71963 by VulnCheck, as of September 2, 2026, no record for this identifier appeared in the official MITRE CVE List. The incident highlights a broader class of vulnerabilities affecting multiple AI coding agents, where the underlying "plumbing" of Git operations is exploited to turn the act of opening a repository into a vector for code execution.