An AI agent helped hackers collect files, then its chat logs exposed their work

Hackers delegated work to an AI agent, but its records helped investigators reconstruct the operation. CloudSEK's November 11 report describes Hermes configurations and conversations on an exposed Silent Lynx server.

The researchers say the open-source agent assisted reconnaissance, document collection and log cleanup. The activity involved more than 2,000 Tajik government files. Reuters interviewed CloudSEK about the findings.

This goes beyond asking a chatbot for advice: agents can operate tools. Human operators still issued instructions, while software handled parts of the workload and left revealing records.

Initial access relied on stolen employee credentials, not an independently discovered AI exploit. The findings remain the researchers' assessment; relevant governments did not immediately respond to Reuters. Tool and file permissions matter as agents gain execution powers.

Source times: CloudSEK, November 11, 2026, 19:34:26 Beijing / 6:34:26 AM EST; Reuters, same date, 19:07:17 Beijing / 6:07:17 AM EST.