Summary
- Between 1–4 July, AI agents built on open-source Hermes and OpenClaw frameworks conducted up to 12 coordinated attack waves against Taiwanese government systems.
- The agents autonomously mapped 21 connected government systems, cracked 85 staff accounts via password spray, solved CAPTCHAs with 100% accuracy, and exfiltrated over 2,500 personnel records.
- The campaign pivoted laterally to Taiwan’s nuclear safety agency, government IT supply-chain vendors, a government email system, and more than seven energy companies.
- The framework included autonomous ‘learning cycles’ — searching vulnerability databases and GitHub repositories for exploitable CVEs — and self-corrected its own errors without human intervention.
- Operational documentation recovered from a 160 MB archive points to a Chinese-language operator, though no specific group or state attribution has been made by researchers.
What happened
Over four days in early July, a threat actor deployed a multi-agent AI framework against Taiwanese government infrastructure in what Israeli cybersecurity firm Dream has described as a near-autonomous attack. The operation ran from 1 to 4 July, executing 12 distinct attack waves across up to eight AI sub-agents, each assigned its own targets and techniques. Dream published its findings this week after researchers discovered a 160 MB online archive containing 1,395 files that documented the operation in detail. The Financial Times first identified Taiwan as the target; Dream itself referred only to ‘government entities in Asia.’
How the agents operated
The attack began with reconnaissance. The agents ingested a single government portal and extracted embedded URLs, API endpoints, OAuth client IDs, and Keycloak configuration objects, ultimately mapping 21 connected government systems and every supported authentication flow. On one target alone, the framework discovered more than 36 API endpoints covering account management, file upload, and administrative functions — many requiring no authentication at all. One system exposed its entire user database without any authentication gate, handing over thousands of employee records including names, departments, and single sign-on account IDs.
Account compromise and data extraction
With employee usernames harvested from the unauthenticated API, the agents moved to credential attacks. They identified three hidden API endpoints that returned valid authenticated sessions without requiring credentials, and separately tested predictable password patterns derived from employee IDs — a classic but effective password-spray approach. Eighty-five accounts were cracked; 84 of those authenticated successfully against the department’s internal information system, granting access to internal dashboards, equipment management interfaces, and personnel statistics pages. The total haul included more than 2,564 personnel records, a full JSON export of department system users, seven SSO client secrets, and six internal database credentials spanning MSSQL, Oracle, and Sybase platforms.
Lateral pivot to critical infrastructure
After exhausting the initial government target, the agents expanded the operation outward. According to Dream’s research, they scanned Taiwan’s nuclear safety agency, government IT supply-chain vendors, a government email system, and more than seven energy sector companies in parallel, probing each for misconfigurations, exposed administrative interfaces, and known exploitable vulnerabilities. The breadth and speed of this lateral movement — running concurrently rather than sequentially — illustrates how an agentic framework can compress what would traditionally require weeks of manual effort into hours.
Autonomous learning and self-correction
Two capabilities in the framework are particularly notable for defenders. First, the agents implemented what the tooling called ‘learning cycles’ — autonomous sessions in which the models searched vulnerability databases, GitHub repositories, and security research publications to identify specific CVEs and weaknesses relevant to the target environment. Second, when the framework made an error, it detected and corrected itself through its own verification process without human intervention. Both capabilities reduce the skill floor required to operate such a campaign and increase the pace at which an attacker can adapt.
Attribution and broader context
Dream has not attributed the attack to the Chinese government or any named threat group, stating only that operational documentation ‘points to a Chinese-language operator.’ The framework itself was built on publicly available open-source AI agent tools — Hermes and OpenClaw — meaning the underlying capability is not proprietary or state-exclusive. Separately, at Black Hat last week, OpenAI technical staffer Michael Dalton said, in the context of a briefing on an unrelated AI-driven attack on Hugging Face, that ‘AI orchestrated, fully automated offensive attacks are real now,’ and warned that weaponised agent collectives should be expected from threat actors in the near future.
Why it matters
This incident is a practical demonstration of what the security community has been modelling theoretically: an AI agent framework conducting reconnaissance, credential harvesting, CAPTCHA bypass, lateral movement, and data exfiltration with minimal human direction, across both government and critical infrastructure targets, in under 96 hours. For CISOs, the risk calculus changes when an attacker’s tooling can autonomously discover unauthenticated API endpoints, adapt its techniques mid-campaign, and pivot to supply-chain vendors and nuclear safety or energy sector systems without waiting for operator input. The exposure surface is not new — unauthenticated APIs, predictable credential patterns, and interconnected government portals are longstanding hygiene failures — but the speed and autonomy with which they can now be chained together is.
What to do now
- Audit all externally and internally facing APIs for authentication requirements; the incident involved multiple endpoints that returned valid sessions or full user databases without any credentials.
- Review password policies to eliminate predictable patterns tied to employee IDs or other enumerable attributes, and enforce account lockout or rate-limiting to blunt password-spray attempts.
- Map your organisation’s interconnected systems from an attacker’s perspective — the agents identified 21 connected systems from a single portal; understand what your own portals expose.
- Assess supply-chain and third-party vendor access to internal systems, given the campaign pivoted directly to IT supply-chain vendors after initial government compromise.
- Evaluate CAPTCHA and bot-mitigation controls, noting that the AI agents solved the target’s CAPTCHAs with 100% accuracy using current open-source tooling.
- Extend threat monitoring to cover parallel scanning behaviour across multiple subsidiaries or connected entities simultaneously, which is a signal consistent with agentic attack frameworks.
