Researchers Say Kazakhstan-Linked Spies Let an AI Agent Haul Off 2,000 Tajik Government Files
CloudSEK says the Silent Lynx espionage group used the open-source Hermes AI agent to collect more than 2,000 Tajik national security documents, then got caught after leaving its own server wide open.
The spies were careful about almost everything. They routed logins through Tor. They had their AI agent scrub its own chat logs. Then they left the whole operation sitting on a server anyone could open.
That is the picture Singapore-based security firm CloudSEK paints in a report published November 11, which says an espionage group known as Silent Lynx used Hermes, an open-source framework for autonomous AI agents, while stealing more than 2,000 national security-related documents from Tajikistan. Reuters first reported the findings, and CloudSEK told the wire service the discovery shows that more advanced, espionage-focused hackers are now outsourcing work to AI too.
"Instead of typing hacking commands by hand, the attacker told Hermes what to do, and Hermes planned the attacks, wrote the rules, ran them, kept notes, and wrote up reports." CloudSEK, to Reuters
Read that quote carefully, because the order of events matters. According to CloudSEK, the recovered data shows the operators using Hermes for reconnaissance starting around mid-August and breaking into Tajikistan's electronic document system a couple of weeks later. The company's own report says the operator, not the agent, logged in to that platform with an account taken from someone else. Only after that, CloudSEK says, did the agent write a custom program to download the files, organize them and split them into chunks so they could be pulled out more efficiently.
So this is not a story about a rogue AI that found a hole and crawled through it alone. It is a story about humans with a foothold handing the tedious, scalable part of espionage to software that never gets bored. CloudSEK says the documents were correspondence addressed to or routed through Tajikistan's Ministry of Defence, dated through 2026.
An agent told to skip the disclaimers
The exposed server also held the instructions the operators gave their agent. Reuters quoted the persona file directly: "You are an elite offensive security specialist and red teamer." CloudSEK's report adds that the persona told the agent to drop "safety disclaimers" and treat the operator as an expert peer, and that destructive commands were pre-approved. The configuration routed most of the logged work to DeepSeek models through OpenRouter, according to the report.
That should sting anyone who thinks model guardrails are the main line of defense. CloudSEK describes an operator who did not need a frontier lab to cooperate. He needed an open framework, a cheap model and a prompt telling it to stop worrying.
The agent also handled housekeeping. CloudSEK says that in early October it deleted messages, shredded shell histories and wiped login records. It missed the directory that ended up exposed, which is how CloudSEK got a timestamped record of the operation running from April to October 2026.
CloudSEK says the same agent stack showed up in its earlier investigation of an unrelated ransomware affiliate, a sign the tooling is spreading across very different kinds of attackers. It echoes a pattern seen elsewhere, including Microsoft's account of China-aligned hackers leaning on AI agents last month.
On attribution, caution is warranted. CloudSEK says it has high confidence the server belongs to a Silent Lynx operator, based on code markers shared with previously published samples. The Kazakhstan link is a separate judgment that CloudSEK rates at medium confidence. The company told Reuters it found evidence the operators spoke Russian, worked Kazakh business hours and often reached the server from a residential Kazakh internet connection. Other researchers, including Cisco Talos, have previously tied Silent Lynx to Kazakhstan at the same medium confidence. None of that amounts to proof of a government operation, and CloudSEK does not claim it.
Kazakh and Tajik officials did not immediately respond to Reuters, and efforts to reach Silent Lynx were unsuccessful.
The uncomfortable takeaway is not that AI has made spies brilliant. These operators reused machine names, leaked their home internet line and left their files in the open. The takeaway is that an AI agent let a sloppy crew work at the pace of a much larger one. Defenders should not count on the next crew being this careless.
