CloudSEK got lucky this week in a way that should worry everyone else. A Kazakhstan-linked espionage group called Silent Lynx left a command-and-control server exposed, and inside it researchers found something security teams have talked about as a future risk for two years and rarely found documented in the wild: a state-aligned actor handing an intrusion to an autonomous AI agent and mostly stepping back. The group used Hermes, an open-source agent framework, to break into Tajikistan’s electronic document management system and steal more than 2,000 national-security files. The operators gave Hermes high-level goals. The agent planned the reconnaissance, wrote and executed the intrusion steps, kept its own operational notes, and generated an after-action report when it was done.

That is a different animal from what we have seen so far this year. The Aurora ransomware campaign documented in September had a human operator directing Cursor interactively through role-play prompts, compressing an intrusion timeline by using AI as a faster keyboard. Silent Lynx’s use of Hermes is the agent doing the planning and execution itself, with a human issuing objectives rather than commands. Practitioners should care about this now because the gap between “AI-assisted intrusion” and “AI-run intrusion” was supposed to be the thing buying defenders time to build detection for the latter. CloudSEK’s exposed-server catch suggests that gap has already closed for at least one state-aligned group, and the only reason we know about it is operational sloppiness on the attacker’s side, not anything a defender did.

Analysis

Start with what the recovered logs actually show, because the detail matters more than the headline. Reconnaissance began in mid-August and document theft started roughly two weeks later, a timeline consistent with an agent doing its own target mapping rather than working from a pre-built playbook. The operators issued goals, not scripts. Hermes chose its own intrusion sequence, executed it, and documented its own results well enough that CloudSEK could reconstruct the campaign from the agent’s own notes rather than from forensic artifacts on the victim side. That is the detail worth sitting with: the attacker’s own audit trail, generated by the agent for the operator’s benefit, became the researcher’s primary source. Autonomous agents log their reasoning as a feature, not a bug, which means the same property that makes them useful to operators makes them a liability the moment their infrastructure is exposed.

That liability cuts the other way for defenders, too. If agent frameworks produce detailed self-documentation as a matter of course, that is a new category of evidence that simply did not exist when a human operator ran tools by hand. The problem is that nobody is positioned to collect it except the attacker, unless defenders start looking for the frameworks themselves, not just their output. Hermes is open source and unremarkable as software. There is no vendor to subpoena, no license key to revoke, no update channel to monitor. It is a GitHub repository anyone can clone, which means the barrier to a second group replicating what Silent Lynx did is a weekend of setup, not a procurement cycle.

The second development this week belongs to a completely different failure mode but rhymes with the first: trust in infrastructure outrunning anyone’s ability to monitor it. On November 8, independent researcher Sean Bales published a GitHub repository called Able2Shell disclosing 33 unpatched vulnerabilities, with working exploit code, against N-able’s N-central remote monitoring and management platform. N-central sits inside thousands of managed service provider environments with broad administrative reach into every client network those MSPs touch. N-able took hosted N-central environments offline and rushed hotfixes for the worst flaws, including an XXE issue rated 9.3 and a privilege escalation bug at 8.6, after honeypot operators recorded exploitation attempts within hours of the dump going public. There was no coordinated disclosure window. There was no 90-day grace period for MSPs to patch before exploit code was sitting in a public repository with a cute name. Attackers did not need to find anything; they needed to read a GitHub README.

The structural point is the same one the industry keeps rediscovering with RMM platforms: a single compromised control plane opens every door it was trusted to manage. SolarWinds taught this with Orion in 2020, Kaseya taught it again with VSA in 2021, and N-central is teaching it a third time, each case substituting a different initial-access method, nation-state implant, ransomware affiliate, now a researcher’s full-disclosure dump, for the same downstream consequence: one platform compromised, every client exposed at once. The vector keeps changing; the architecture has not, because fixing it means MSPs giving up the centralized control that is the platform’s entire value proposition.

Both stories this week are versions of the same defender blind spot: visibility stops at the boundary of what an organization directly operates. Silent Lynx’s agent ran on infrastructure nobody but Silent Lynx controlled, until they left it open by accident. N-central ran inside MSP environments where client organizations had no visibility into the platform’s code quality and no say in the disclosure timeline a third-party researcher chose. Neither failure was something a target’s own security program could have caught; in both cases the exposure happened one or two hops upstream of anyone who was looking.

Escalations from Monday

The clearest material change since Monday is attribution, not technique. French Foreign Minister Jean-Noel Barrot told the G7 summit on November 9 that Iran’s IRGC, acting through its Shahid Kaveh cyber and electronic warfare unit, directed the October 11-12 sabotage that disabled refrigeration controllers at roughly 700 French retail sites and caused at least 15 fires. French investigators have named three Iranian nationals and are pursuing arrest warrants, moving this from an unattributed industrial-control incident to a named state actor with named individuals facing prosecution. That attribution followed a joint CISA, FBI, HHS, USDA and Department of Transportation advisory on November 5 warning that the same activity is actively hitting cold-chain systems tied to US military bases, retailers, and at least one blood bank. Shahid Kaveh has held scanning and access capability against Schneider Electric, Siemens, and Rockwell controllers since mid-2024. What changed this week is not the threat actor’s capability, which was already known, but the confirmation that opportunistic ICS scanning by this unit has graduated into sustained physical-effect sabotage with a food-supply impact, and that the campaign is still active against new targets rather than contained to the October incident.

What to watch

Watch for whether a second state-aligned group gets caught running an agent framework end-to-end the way Silent Lynx did with Hermes. CloudSEK found this one because the operators got careless with their own server; the next group that does this correctly may not leave a trail, and the industry’s detection posture for agent-run intrusions is close to nonexistent regardless. Also watch N-able’s post-incident disclosure: the honeypot activity observed within hours of Able2Shell going public suggests mass scanning is already underway, and the real test is whether exploitation reaches MSP clients who have not yet applied the hotfixes before next week’s report.

Security Unlocked publishes threat intelligence and strategic analysis twice weekly. This mid-week brief covers developments from Monday, November 9, 2026 through Thursday, November 12, 2026.