Astana / Dushanbe, 11 November. A group of hackers whom researchers link to Kazakhstan used an artificial intelligence (AI) agent to steal more than 2,000 documents related to Tajikistan’s national security, CloudSek told Reuters.
CloudSek is a Singapore-based cybersecurity company; it published a report on the matter on 11 November.
CloudSek says it caught the hackers when they inadvertently left a server exposed to the internet. They were using Hermes, an open-source framework for autonomous AI agents. “Instead of typing hacking commands by hand, the attacker told Hermes what to do, and Hermes planned the attacks, wrote the rules, ran them, kept notes, and wrote up reports,” CloudSek told the agency.
According to the data the company recovered, the hackers began using Hermes for reconnaissance around mid-August and, a couple of weeks later, broke into Tajikistan’s electronic document system. The agent then wrote a custom program that downloaded the files, organised them and broke them into chunks to steal them more effectively. Among the data CloudSek found were the hackers’ instructions to the agent, including: “You are an elite offensive security specialist and red teamer.” A “red team” is a group of cybersecurity professionals who simulate covert attacks to test an organisation’s defences.
CloudSek assigns the hackers to a group nicknamed Silent Lynx, which, as Reuters notes, other researchers have already tied to Kazakhstan. The company says it found evidence that the hackers spoke Russian, worked Kazakh business hours and often accessed the exposed server through a residential Kazakh internet connection. The agency could not reach the group. Officials in Kazakhstan and Tajikistan did not immediately respond to its requests for comment.
Reuters recalls that it had earlier reported on cybercriminals assigning break-ins to autonomous AI agents. In CloudSek’s view, the new finding shows that more advanced, espionage-focused groups are doing the same.
What it means: That AI helps hackers has been reported before. What is new in the report is a cycle in which the agent itself planned and carried out the attacks while a human only set the task. Kazakhstan’s involvement is a conclusion drawn by researchers from indirect signs: language, working hours and an internet connection. There is no confirmation from the authorities of either country so far.
What we know now: CloudSek’s report came out on 11 November. It names the group Silent Lynx, puts the number of stolen documents at more than 2,000 and names the tool as Hermes. Which documents and which Tajik agencies were affected is not specified in Reuters’ account. Who is behind the group, and whether it works for a state, is unknown. There has been no official reaction from Astana or Dushanbe.
Background: On 14 October Reuters had already reported on this activity: researchers said hackers likely based in Kazakhstan had targeted a Russian oil refinery and compromised a Russian municipal government network. They also said they had found evidence of a breach of a Tajik government agency around the time Kazakhstan was ratifying a treaty with Tajikistan in early 2026. The campaign, they assessed, lined up with Kazakhstan’s strategic interests. The hackers could not be reached then either.
