A hacking group tied to Kazakhstan recently used artificial intelligence to steal more than 2,000 national security-related documents from neighbouring Tajikistan, according to a report published on Wednesday by a cybersecurity company.
Singapore-based CloudSek said it caught the hackers using Hermes, an open-source framework for autonomous AI agents, after they inadvertently left a server exposed to the internet. The firm said the finding shows that more advanced, espionage-focused hackers are also handing their operations to AI. Earlier reporting had largely described cybercriminals doing this.
How the intrusion unfolded
CloudSek said the recovered data showed the hackers using Hermes for reconnaissance from around mid-August. A couple of weeks later, they broke into Tajikistan’s electronic document system. The AI agent then wrote a custom program to download the files, organise them and split them into chunks so they could be stolen more effectively.
CloudSek told Reuters that the attacker did not type hacking commands by hand. Instead, the attacker told the agent what to do, and the agent planned the attacks, wrote the rules, ran them, kept notes and produced reports. The exposed material included the hackers’ instructions to the agent. One line told it that it was an “elite offensive security specialist and red teamer.”
Link to Kazakhstan
CloudSek said the hackers belong to a group nicknamed Silent Lynx, which other researchers have tied to Kazakhstan. The firm said it found evidence that the operators spoke Russian, worked Kazakh business hours and often reached the exposed server through a residential internet connection in Kazakhstan.
Silent Lynx has been tracked by several security firms since at least 2024. In October, Cisco’s Talos research group said it suspected the hackers were working from Kazakhstan, but rated its assessment at medium confidence. The researchers said they had not established whether the hackers were working for a government. A separate Recorded Future report identified computers at a Tajik economic-development institution communicating with servers used by the group.
Wider concern over AI agents
Hermes has also appeared in other espionage cases. In July, Hunt.io reported that the agent largely drove an attack on Thailand’s Ministry of Finance.
Kazakh and Tajik government officials did not immediately respond to requests for comment. Efforts to reach Silent Lynx were also unsuccessful.
