Silent Lynx hackers let Hermes AI agent steal Tajik documents

What did the Hermes AI agent actually do?

The data CloudSek recovered shows reconnaissance starting around mid-August. A couple of weeks later, the agent got into Tajikistan's electronic document system. It then wrote its own program to download the files, organize them and split them into chunks so they could be pulled out more effectively.

The exposed server also held the hackers' instructions to the agent, including how it should see itself and talk to its operators. One line read: "You are an elite offensive security specialist and red teamer." A red teamer is a security professional paid to simulate covert attacks to test an organization's defenses.

Who is Silent Lynx?

CloudSek says the hackers belong to a group nicknamed Silent Lynx, which other researchers have already tied to Kazakhstan. The company points to evidence that the operators spoke Russian, worked Kazakh business hours and often reached the exposed server through a residential Kazakh internet connection.

CloudSek says the case shows that more advanced, espionage-focused groups are now outsourcing their break-ins to AI, something previously reported among ordinary cybercriminals. Kazakh and Tajik officials did not immediately respond to requests for comment, and Silent Lynx could not be reached.