September 14, 2026
Hermes Logs Reveal Unattended AI Post-Exploitation
Hermes AI agent operated in unattended "YOLO" mode during post-exploitation of Thailand's Ministry of Finance, with recovered logs showing host enumeration and credential collection across compromised systems. CVE-2026-46331 demonstrates a sandbox escape from Claude Cowork's local VM boundary, highlighting containment assumptions in agent deployments. GPT-6 Astra shows capability jumps on agent benchmarks (vending and drone tasks) but with significant reliability caveats compared to Claude Fable 5.1. Florida's DAVID driver database was breached via stolen police credentials claimed by ShinyHunters, exposing 2.8 million driver records.