Press play to start listening
A multi-agent software framework was used to automate a four-day operation from 1 July to 4 July 2026 against government systems in Asia, according to Dream Group. The Financial Times identified the target as Taiwan, while Taiwan’s Ministry of Digital Affairs later confirmed an AI-assisted attack on government agencies in July. Dream documented 12 attack waves, 21 connected government systems, 85 cracked employee accounts and at least 2,564 extracted personnel records.
Researchers from Dream Research Labs discovered an archive spanning more than 160MB and containing 1,395 files from the attackers’ operational workspace. The framework was built around the open-source AI agents Hermes created by Nous Research and OpenClaw and could deploy up to eight sub-agents simultaneously, assigning them different targets and attack techniques.
How the Attack Worked
The framework began by mapping government infrastructure through publicly accessible web code, discovering APIs, authentication configurations, and an unauthenticated database containing employee names, departments, and Single Sign-On (SSO) account IDs. It also found exposed developer debug endpoints that provided authenticated sessions without credentials.
Using the stolen employee information, the system automated password spraying against a government portal. It used Tesseract OCR to solve CAPTCHA images and tested predictable password patterns. The operation extracted at least 2,564 personnel-related records, including information on 1,409 employees, 916 users from an unauthenticated API, and 239 legal professionals.
It also obtained seven rotated SSO client secrets that revealed naming conventions, six internal database credentials, and internal network information. The framework later scanned government IT vendors, a nuclear safety agency, a government email system, and at least seven energy-sector companies.
The compromised accounts were then tested against connected internal systems through SSO. Eighty-four of the 85 compromised accounts were successfully used to access an internal information system because an SSO bridge trusted the existing session without additional authentication or MFA.
AI Adaptation and Data Theft
The framework then linked these individual weaknesses into 14 potential attack chains, continuously ranking them by their probability of success and prioritizing the most promising paths. It also conducted five autonomous ‘Learning Cycles,’ searching GitHub, vulnerability databases, and security research for techniques relevant to the target environment and feeding the results back into subsequent attack waves.
The system was not infallible. Dream’s analysis identified seven false positives in its final assessment. In one case, the framework initially interpreted a 21-second delay as evidence of SQL injection before determining that an SMTP timeout was responsible.
The operation ultimately extracted 2,564 personnel-related records, including information on 1,409 employees, 916 users from an unauthenticated API and 239 legal professionals. It also obtained SSO client secrets, database credentials and internal network information. The framework later expanded its activity to government IT vendors, a nuclear safety agency, a government email system and more than seven energy-sector companies.
“Across the campaign’s 12 documented attack waves, we identified agents labeled A through Q, with up to 8 deployed concurrently in a single wave (dispatched in 3 batches). The sheer volume of output — 1,395 files produced in approximately four days — is consistent with heavy automation far beyond what a human operator could produce alone,” Dream’s researchers explained in the blog post.
Taiwan’s Ministry of Digital Affairs said in its official response that its investigation found clear signs of an overseas source and a hybrid operation combining conventional hackers with AI agents such as OpenClaw.
Taiwan said affected agencies had completed remediation measures and that the government is strengthening monitoring and cross-agency defenses against AI-enabled attacks. Dream’s linguistic analysis pointed to a Chinese-language operator, although neither the company nor Taiwanese authorities publicly attributed the attack to China.
Industry Reaction and Expert Views
In comments shared with Hackread.com, security industry leaders warned that this incident marks a fundamental shift in cyber warfare economics.
Aviv Nahum, Co-founder and CEO at Above Security, explained that the core issue lies in operational velocity, stating, “This is an important moment, but not because AI invented a new way to hack. The techniques are familiar. What changed is who, or increasingly what, can execute them. We are moving into a world where AI agents have identities, credentials, permissions and the autonomy to operate across systems at machine speed.”
“The unit cost of running a capable intrusion has fallen off a cliff because AI has closed the skills gap, using open-source and free tooling, while the cost of defending an enterprise hasn’t moved at all… What it can’t do is know which of your 21 systems actually matters to the business or spot the one weird misconfiguration a seasoned researcher would flag on sight.”
Matt Hartman, Chief Strategy Officer at Merlin Group, warned that private sector firms must prepare for similar speed: “AI compresses reconnaissance from days of work into minutes, which means private sector organizations should expect adversaries to find and exploit weaknesses faster than human teams can triage them.”
Ram Varadarajan, CEO at Acalvio, described the emerging dynamic as “bot-on-bot,” while Agnidipta Sarkar, Chief Evangelist at ColorTokens, concluded that organizations must limit network movement: “We must pivot toward building hardened digital landscapes by denying unauthorized lateral movement by default… Single Sign-On (SSO) without step-up Multi-Factor Authentication (MFA) or identity-bound session-level microsegmentation creates a single point of failure.”
