Key facts
- CloudSek said the hackers used Hermes, an open-source framework for autonomous AI agents, to plan and run the attacks.
- CloudSek said the AI agent wrote a custom program to download, organize and split the stolen files into chunks.
- CloudSek said the hackers belonged to a group nicknamed Silent Lynx, which other researchers have tied to Kazakhstan.
- CloudSek said it found evidence the hackers spoke Russian, worked Kazakh business hours and often used a residential Kazakh internet connection.
- Kazakh and Tajik government officials did not immediately respond to requests for comment, Reuters reported.
A hacking group tied to Kazakhstan used an open-source AI agent framework to steal more than 2,000 national security-related documents from neighboring Tajikistan, Singapore-based cybersecurity company CloudSek said in a report published on November 11, 2026.
CloudSek said it caught the cyber spies using Hermes, an open-source framework for autonomous AI agents, after they inadvertently left a server exposed to the internet. "Instead of typing hacking commands by hand, the attacker told Hermes what to do, and Hermes planned the attacks, wrote the rules, ran them, kept notes, and wrote up reports," CloudSek told Reuters.
CloudSek said the data it recovered showed the hackers using Hermes for reconnaissance beginning around mid-August and breaking into Tajikistan's electronic document system a couple of weeks later. It said the AI agent then wrote a custom program to download the files, organize them, and break them into chunks to steal them more effectively.
Among the exposed data were instructions from the hackers to their AI agent and guidelines on how it should see itself, operate and communicate with the hackers running it. "You are an elite offensive security specialist and red teamer," the instructions stated. A red teamer is a cybersecurity professional who simulates covert attacks to test an organization's systems.
CloudSek said the hackers belonged to a group nicknamed "Silent Lynx," which other researchers have tied to Kazakhstan. CloudSek said it found evidence the hackers spoke Russian, worked Kazakh business hours and often accessed the exposed server through a residential Kazakh internet connection. Efforts to reach Silent Lynx were unsuccessful.
Kazakh and Tajik government officials did not immediately respond to requests for comment.