Hackers Let an AI Agent Steal 2,000 Tajik Government Documents, Researchers Say

admin · November 11, 2026 · 7 min read

Illustration of an autonomous AI agent accessing government documents on a computer screen, representing the Silent Lynx cyberespionage operation

A hacking group linked to Kazakhstan handed much of a real espionage operation to an autonomous AI agent — and the agent did the work. It scouted the target, broke into Tajikistan’s government document system, wrote its own program to steal the files, and cleaned up its tracks, according to a report published Wednesday by Singapore-based cybersecurity firm CloudSEK.

The theft netted more than 2,000 national-security-related documents, including material addressed to or passed through Tajikistan’s Ministry of Defence. Researchers say it is one of the clearest public records yet of a state-aligned spying group letting an AI agent run the routine parts of an intrusion.

How the operation unfolded

CloudSEK discovered the operation by accident. The hackers left one of their own servers exposed to the internet without authentication, and the open directory gave researchers a timestamped record of the group’s tools, intrusions and AI agent conversations spanning April to October 2026.

According to the report, titled “Off the Rails: Inside an Exposed Silent Lynx Server,” reconnaissance began around mid-August. A couple of weeks later, the attackers broke into Tajikistan’s electronic document system. The AI agent then wrote a custom program to download the files, organize them and break them into chunks so they could be stolen more effectively.

“Instead of typing hacking commands by hand, the attacker told Hermes what to do, and Hermes planned the attacks, wrote the rules, ran them, kept notes, and wrote up reports,” CloudSEK told Reuters.

Hermes is an open-source framework for building autonomous AI agents. In this operation, most of the models running behind it were DeepSeek models, according to the report. The agent was self-hosted, and the operator could task it from a phone through a Telegram bot. Collectors pulling government documents posted progress updates to a Telegram chat, and every command the agent received came from a single Telegram account with the display name “Marat.”

The exposed data also contained the instructions the hackers gave their agent, including guidelines on how it should see itself, operate and communicate with the people running it. “You are an elite offensive security specialist and red teamer,” the instructions stated. A red teamer is a cybersecurity professional who simulates covert attacks to test an organization’s defences.

A group tracked since early 2025

CloudSEK attributes the operation to a group researchers call Silent Lynx, a Central Asia-focused espionage cluster that has been tracked publicly since January 2025, when it was first named by security firm Seqrite. Other researchers have tied the group to Kazakhstan.

The firm says it has high confidence that the exposed server belongs to a Silent Lynx operator, based on implant code markers and build paths shared with previously published samples. Its confidence in the Kazakhstan connection is only moderate: the operation ran in Russian, the operator worked Kazakh business hours, and the operator’s own test traffic came from a residential Kazakh internet connection. The report does not conclude that the Kazakh government directed the operation.

Kazakh and Tajik government officials did not immediately respond to requests for comment, Reuters reported. Efforts to reach Silent Lynx were unsuccessful.

The server itself was a Debian virtual private server on Baxet Group infrastructure, exposed without authentication on port 8088. Inside, researchers found the group’s tooling alongside data from active intrusions into government and critical infrastructure organizations across the region.

The implants matched Silent Lynx’s known Laplas and Chvost families, alongside a previously unreported generation of service-installer implants and a new variant for bypassing Windows’ Antimalware Scan Interface, a defence that inspects scripts and code before they run.

Beyond Tajikistan

The breach of Tajikistan’s document system was not the group’s only foothold. CloudSEK said the operator held persistent, domain-level access to transport-sector networks and used a single compromised employee account to collect government correspondence at scale, including defence-related documents. The operator also had access to a state railway’s internal network from mid-August until at least October 10.

The exposed server also pointed to the group’s next target. Lures impersonating Turkmenistan Railways and a Turkmen regional administration were built and tested in October 2026, suggesting an upcoming campaign against Turkmenistan.

Earlier reporting lines up with the new findings. In October 2026, Cisco Talos and Recorded Future documented four Silent Lynx infection chains running from mid-2025 to August 2026, involving the Chvost, Laplas and PickleShell reverse shells, and assessed the Kazakhstan connection at medium confidence. Seqrite’s original January 2025 report described government targets in Kyrgyzstan and neighbouring countries, with Telegram used for command and control.

Why this matters

Reuters previously reported on cybercriminals assigning their break-ins to autonomous AI agents. CloudSEK said its discovery showed that more advanced, espionage-focused hackers were now doing the same — outsourcing the hacking itself to AI.

That shift matters for defenders. An AI agent that can plan reconnaissance, write its own collection tools, tidy its logs and report back to its operator over Telegram can run an intrusion at machine speed and with far less hands-on effort from the humans behind it. It also lowers the skill barrier: a small team can mount a campaign that once required a larger, more experienced crew.

For American readers, the lesson is practical rather than abstract. The same open-source agent frameworks are available to anyone, and the same techniques work against any poorly defended network — a government document system in Central Asia today, a US company, hospital or local government office tomorrow. The exposed server in this case was the group’s own mistake, but it also shows how much of an espionage operation can now run with almost no human typing.

The incident also exposes the limits of attribution. CloudSEK’s moderate-confidence link to Kazakhstan rests on language, working hours and internet connections — suggestive, but not proof of who ordered the operation. Readers should treat the Kazakhstan connection as the researchers’ assessment, not as an established fact about the Kazakh government.

Espionage and hacking cases have filled the news in recent weeks: Google patched its eighth Chrome zero-day of the year; a U.S. Army soldier arrested in Britain on suspicion of spying for Russia; and three Iran-backed operatives charged over alleged plots in the United States and Europe.

What happens next

CloudSEK’s report is public, which means other security teams can now study the group’s tools, infrastructure and AI agent setup. Expect vendors to publish detection rules for the Laplas and Chvost implants and for the Hermes-based agent configuration found on the exposed server.

The more important question is whether other espionage groups follow the same path. If autonomous agents become a standard part of state-aligned hacking, defenders will need to hunt for the abuse signatures — unusual agent activity, unexpected Telegram traffic, self-hosted AI models on compromised servers — rather than waiting for a human attacker to make a mistake.

For now, the Silent Lynx case stands as a warning and a preview: the AI agent is no longer just a tool that helps hackers write code. In this operation, it did the hacking.

Frequently Asked Questions

What is Silent Lynx?

Silent Lynx is a Central Asia-focused cyberespionage group tracked publicly since January 2025. Researchers have tied it to Kazakhstan at medium confidence, based on language, working hours and internet connections, but the CloudSEK report does not conclude that the Kazakh government directed the operation.

What did the hackers steal?

More than 2,000 national-security-related documents from Tajikistan’s government, including material addressed to or passed through the country’s Ministry of Defence. The group also held persistent access to transport-sector networks and a state railway’s internal network.

What is Hermes, the AI agent framework?

Hermes is an open-source framework for building autonomous AI agents. In this operation it ran mostly on DeepSeek models, planned attacks, wrote its own collection program, cleaned up logs and reported progress to its operator over Telegram.

How was the operation discovered?

The hackers left one of their own servers exposed to the internet without authentication. CloudSEK found the open directory, which contained a timestamped record of the group’s tools, intrusions and AI agent conversations from April to October 2026.

Sources: