Singapore-based cybersecurity firm CloudSEK uncovered that a group called Silent Lynx used Hermes, an open-source AI agent built on DeepSeek models, to automate espionage against Central Asian governments. The researchers found an exposed server containing over a dozen gigabytes of stolen documents, hacking tools and logs showing the AI agent performing reconnaissance, data collection and trace-erasing, and even executing potentially destructive commands without extra approval. The operator communicated with the agent in Russian via a Telegram bot. One major intrusion gave the hackers sustained access to Tajikistan’s national railway network from mid-August through early October, letting them steal login credentials, internal documents and thousands of files from the Defense Ministry and other agencies. CloudSEK also detected compromise of a server supporting Uzbekistan’s Smart Forestry initiative and test files for a possible Turkmenistan phishing campaign. 1