A hacking group linked by researchers to Kazakhstan used artificial intelligence to steal more than 2,000 national security-related documents from neighbouring Tajikistan, Singapore-based cybersecurity firm CloudSek said in a report published on Wednesday, November 11. Reuters reported the findings from Washington the same day.

CloudSek said the group, nicknamed “Silent Lynx”, used Hermes, an open-source framework for autonomous AI agents, to carry out the operation. The firm said it caught the spies only after they inadvertently left a server exposed to the internet.

How the operation unfolded

According to CloudSek, the data it recovered showed the hackers using Hermes for reconnaissance beginning around mid-August, and breaking into Tajikistan’s electronic document system a couple of weeks later. The stolen material was described as more than 2,000 national security-related documents.

CloudSek said its discovery showed that more advanced, espionage-focused hackers were also outsourcing their hacking sprees to AI — a warning that AI tools are no longer limited to low-level fraud or spam, but are being used in state-linked espionage.

Why researchers link the group to Kazakhstan

CloudSek said the hackers belonged to a group nicknamed “Silent Lynx”, which other researchers have tied to Kazakhstan. The firm said it found evidence that the hackers spoke Russian, worked Kazakh business hours and often accessed the exposed server through a residential Kazakh internet connection.

That evidence is circumstantial, and it does not by itself prove that the Kazakh government ordered or directed the operation. Neither the Kazakh nor the Tajik government had publicly responded to the report in the reporting reviewed, and Reuters said efforts to reach Silent Lynx were unsuccessful.

What is known — and what is not

The report lands at a time when governments across Central Asia are tightening cyber defences, and when AI agents that can plan and run multi-step tasks on their own are becoming widely available. CloudSek’s finding suggests the same tools that can automate ordinary office work can also automate the reconnaissance and break-in stages of an espionage campaign.

For Tajikistan, the breach raises questions about the security of its electronic document system and about how the stolen material might be used. For the wider region, it is a reminder that a single exposed server can undo the security of a whole government system — and that attribution in cyber espionage is rarely as simple as a single clue.

CloudSek has not said whether it shared its findings with the Tajik authorities before publication, and the full report was the basis for Reuters’ account. No arrests or public attribution by any government were reported in the coverage reviewed.