Hackers put an AI agent to work as a spy, then got caught by their own open server

What happened

On November 11, 2026, Singapore-based security firm CloudSEK published a report titled “Off the Rails: Inside an Exposed Silent Lynx Server.” It describes how the hacking group Silent Lynx used an autonomous AI agent to spy on governments in Central Asia. Tajikistan was hit hardest. The attackers took more than 2,000 government documents, including correspondence to or about the Ministry of Defense. Reuters and The Record covered the findings, as did the Indonesian outlet Industry.co.id and InfotechLead.

What makes this case stand out is that, according to the report, it's one of the first well-documented examples of a freely available AI agent working on a real espionage operation from start to finish. It handled everything from reconnaissance and data collection to covering the attackers' tracks. The irony is that the whole thing came to light because the attackers failed to secure their own server.

Who is Silent Lynx?

Silent Lynx has been linked to attacks on governments in and around Central Asia for some time. According to The Record, the group has previously gone after Kyrgyzstan, Turkmenistan, Tajikistan, Armenia, Belarus and Russia.

CloudSEK says it has high confidence that the server belongs to Silent Lynx because the malware's code and build paths match previously published samples. It's less sure about the group's origin, attributing it to Kazakhstan with only medium confidence. The clues: the operators spoke Russian, test traffic came from a residential Kazakhtelecom internet connection, and activity happened only during business hours in the UTC+5 time zone. Both CloudSEK and The Record stress that there is no evidence of any link to the Kazakh government. According to InfotechLead, Kazakh and Tajik officials did not initially respond to Reuters' requests for comment.

How the AI agent worked

Hermes is an open-source framework for autonomous agents. It's freely available software that lets a language model take actions on its own instead of just answering questions. Agents like this have long-term memory. They can hand tasks off to sub-agents (helpers that handle parts of a job in parallel), run scheduled jobs via cron (the Linux task scheduler), and operate both the command line and a browser.

On the hackers' server, the agent was called “Strix.” It was told to act as a cyberattack specialist and to ignore security warnings. According to InfotechLead, one instruction told it to behave like an “elite offensive security specialist and red teamer.” Red teams are normally security professionals that companies hire to simulate attacks and uncover weaknesses.

The agent was deliberately set up to be aggressive. CloudSEK found that it could run dangerous commands, such as dropping database tables, without asking for confirmation, and that a safeguard against endless task loops had been turned off. The operators gave it instructions in Russian through a Telegram bot, so they could control it right from their phones.

According to CloudSEK, the agent used DeepSeek V4.1 Flash as its main model and Gemini 2.5 Flash for parallel sub-agent tasks. Both were accessed through OpenRouter, a service that offers many AI models through a single API.

Compiled from the CloudSEK report.

InfotechLead adds that the attackers began using Hermes for reconnaissance around mid-August 2026. About two weeks later, the electronic document system was compromised. The agent then reportedly wrote its own program that downloaded documents, sorted them and split them into smaller chunks so they could be exfiltrated with less chance of detection.

The victims and how the attackers got in

The main target was Tajikistan's national railway. From mid-August until at least October 10, 2026, the attackers had domain-level access there. Put simply, that means admin rights over the entire corporate network. They got in through an ISP's network devices that were still using default passwords and through old, unpatched Windows servers.

From there, they logged in to the government's electronic document system portal using an ordinary railway employee's account. The system didn't check access rights on individual documents, so they could pull files well beyond the railway's own records. In total they took more than 2,000 documents. According to CloudSEK, the documents are dated as recently as 2026, and many relate to the Ministry of Defense.

In Uzbekistan, the attackers took over a server and its database that run the “Smart Forestry” project. For Turkmenistan, CloudSEK found phishing lures, such as fake train tickets, that were created and tested in October 2026. According to The Record, it's unclear whether those attacks succeeded.

Betrayed by their own server

The biggest mistake was the hackers' own. Their server exposed a directory on port 8088 to the internet with no authentication at all. It contained more than a dozen gigabytes spread across hundreds of thousands of files: phishing kits, malware, stolen documents, and the Hermes agent's complete memory and logs.

The agent did run a cleanup in early October 2026, but it missed this open directory. Its own records even contained full SSH logs, which are records of remote access to machines, from before those logs were deleted. Industry.co.id sums it up well: the AI agent sped up the work, but it was no substitute for good operational security. A single misconfiguration was enough to expose the entire operation.

Why it matters

The case is notable because it comes from a real espionage campaign, not a lab test or a demo. And because the server was left open, it's unusually clear what the agent actually did. InfotechLead notes that Reuters previously reported on criminals using AI agents to hijack multiple websites. This case, however, involves espionage that may be state-linked and that targeted sensitive government documents. Tools like this could let small groups run much larger operations without adding staff.

At the same time, the case shows that AI didn't create any new superweapons here. The weaknesses the attackers exploited are textbook: default passwords on routers, outdated protocols like SMBv1, unpatched servers and no permission checks on individual documents. AI simply made those gaps faster to find and exploit. Basic security hygiene is still the best defense.

It's also striking that the attackers used commercially available models from DeepSeek and Google through an ordinary routing service. That suggests the providers' safeguards apparently failed when the models were used as agents. The sources don't say how the providers have responded. If you run AI agents with terminal access, API keys and chatbots yourself, treat this case as a warning. These systems need to be locked down tightly, and that includes checking whether any working directory is exposed to the internet. Attribution also remains unsettled: the link to Kazakhstan is only medium-confidence, and there's no evidence of state involvement.