AI Risk Wire

Cases › security breach › LR-2026-0734

Hackers turn AI agent into cyber weapon by deleting safety refusals

Preliminary Why: 1 report: GBHackers Security · subject to change · 1 independent report

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: no action reported

Severity major
Reported 17 Sep 2026
Developer and model Nous Research
Agent tool Hermes agent

No source states: loss or records, could do, deployer, industry.

Severity major: Test: many third parties with a stated count of two or more affected parties. Fact: the alleged campaign targeted 1,697 people (a claim, not verified).

A self-hosted Nous Research Hermes agent connected to a DeepSeek model was used as an operational layer by a cybercrime group. According to researchers, the operator removed an instruction from the agent's configuration, replaced it with demands for unconditional execution, and set an environment variable disabling safety. The agent was then used for persistent scanning, secret hunting, Telegram reporting and workflow automation. Researchers reviewed the exposed server through static analysis, passive observation of the exposed panel and public-source collection, without executing malware or logging into actor systems. The most serious alleged activity was a vishing campaign against older French telecom subscribers. Researchers cautioned that public claims should be treated separately from verified access evidence.

What happened

1 · What it was doingThe operator used a Hermes agent connected to a DeepSeek model for scanning, secret hunting, reporting and automation.
2 · What went wrongThe operator allegedly removed a safety instruction, demanded unconditional execution and disabled the safety setting.
3 · What it reached or didThe operation allegedly queued 2.75 million domains and reached more than 726,000 hosts.
4 · How it was caughtResearchers reviewed the exposed material through static analysis, passive observation and public-source collection.

What was done

No source states an action or fix.

Risks

AI used to run a cyber attack
Primary96 incidents
Rising: 24 vs 4.0 a week
Harmful content and jailbreaks
Also84 incidents
Rising: 6 vs 3.8 a week
Credential and privilege abuse
Also37 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Model

Safety training and refusal · Cyber and weapons safeguards · Abuse monitoring and account enforcement · Staged or restricted release · Dangerous-capability testing before release · Outside red-teaming · Content safety classifiers · Safeguards kept on in testing · Reasoning monitoring

Infrastructure / target

Known flaws patched · Multi-factor sign-in and password policy · Network segmentation · Intrusion and endpoint detection · Backups and recovery · Phishing and fraud filters

Evidence

No source states: when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show the full account: 4 items from the primary sources

What happened, in order

Not dated in the sources:

  • Operator allegedly removed the safety instruction and set the safety-disabling variable before the agent was used.
  • The agent was subsequently used for scanning, secret hunting, reporting and automation.
  • The operation allegedly queued 2.75 million domains and reached more than 726,000 hosts during scanning.
  • Downstream, an alleged vishing campaign targeted older French telecom subscribers.
Show every field, with its source and grade

The AI system

Developer
Nous Research
C one secondary source states it
Software around the model
Hermes agent
C one secondary source states it

What happened

Earliest source we hold
2026-09-17
D inferred by us from the described behaviour, reason shown
Who caused it
an outside attacker
C one secondary source states it
What went wrong
security breach
C one secondary source states it
AI agent
an AI agent acted
C one secondary source states it
primary risk
RK07
D inferred by us from the described behaviour, reason shown
secondary risks
RK12, RK03
D inferred by us from the described behaviour, reason shown

Impact

Severity
major
D inferred by us from the described behaviour, reason shown
Kind of harm
money, privacy, others' security
C one secondary source states it
Who was affected
Older French telecom subscribers (alleged vishing target); the claimed access to hosts is also reported as allegation
C one secondary source states it
Kinds of data exposed
identity data, phone numbers, subscriber details, banking identifiers
C one secondary source states it
Why this severity
Test: many third parties with a stated count of two or more affected parties. Fact: the alleged campaign targeted 1,697 people (a claim, not verified).
D inferred by us from the described behaviour, reason shown

Notes on gaps

Control outcomes are my reading of the removed safety layers; the source does not name a provider or integrator. Remediation entries are advice from the researchers, not changes reported by a party.

LR-2026-0734 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON