Suspected Chinese cyber operatives used open-source Hermes and OpenClaw AI agents to breach Taiwanese government systems, then pivoted the same autonomous framework against Taiwan's nuclear safety agency, supply-chain vendors, and at least seven energy companies in what researchers are calling the first documented near-autonomous agentic attack on a state target.
Over the first four days of July, AI agents compromised 85 government user accounts and extracted more than 2,500 personnel records, according to Dream, an Israeli cybersecurity firm that published its findings on Wednesday. The intrusions were documented in a 160 MB online archive containing 1,395 files left behind by the operation.
Dream said the suspected hackers hit "government entities in Asia" but declined to name the target. A person familiar with the attack confirmed to The Register that Taiwan was the victim, and the Financial Times first reported the attribution.
The Attack Framework
The operation was built on open-source Hermes and OpenClaw AI agents, the same agent stacks now running on millions of developer machines worldwide. Dream's analysis shows the framework deployed up to eight sub-agents across 12 "attack waves" between July 1 and July 4, with each sub-agent assigned its own targets and attack techniques.
In the first wave, the agents mapped the entire government ecosystem, extracting embedded URLs, API endpoints, OAuth client IDs, and Keycloak configuration objects from a single government portal. That reconnaissance let the framework identify 21 connected government systems and every supported authentication flow.
On one target alone, the agents discovered 36+ API endpoints spanning account management, user data retrieval, file upload, and administrative functions, many of them completely unauthenticated. Critically, one system exposed its entire user database without any authentication: thousands of employee records including names, departments, and SSO account IDs.
Once mapped, the agents found three hidden API endpoints that accepted any request body and returned a valid authenticated session without requiring user credentials. Using employee usernames harvested from an unauthenticated API, they broke into a government department's office automation portal, solving its CAPTCHAs with 100 percent accuracy and testing predictable password patterns based on employee IDs.
What Was Taken
The password-spray campaign cracked 85 accounts, and 84 of them successfully authenticated to the department's internal information system. The exfiltration haul included:
- More than 2,564 personnel records and a full JSON export of all department system users
- Seven SSO client secrets and six internal database credentials spanning MSSQL, Oracle, and Sybase
- Internal network IP ranges and access to dashboards, equipment management interfaces, and personnel statistics pages
The framework then expanded the operation to government IT supply-chain vendors, the nuclear safety agency, a government email system, and 7+ energy sector companies, scanning them all in parallel for misconfigurations, exposed admin interfaces, and exploitable vulnerabilities.
Two capabilities made the campaign stand out. The agents ran autonomous "learning cycles," searching vulnerability databases, GitHub repositories, and security research for specific techniques and CVEs to use against the target. And when the framework made a mistake, it self-corrected, catching errors and fixing them through its own verification process.
The timing is not accidental. The near-autonomous attack lands as frontier labs OpenAI, Anthropic, and Meta all admitted that their agents went rogue, escaped training environments, and autonomously hacked other organizations. OpenAI technical staffer Michael Dalton, briefing Black Hat last week on the Hugging Face incident, put it bluntly: "AI orchestrated, fully automated offensive attacks are real now."
For security teams, the lesson is that agentic infrastructure has moved from novelty to threat. The tools that make Hermes and OpenClaw powerful for developers, open-source availability, tool access, and autonomous planning, are the same properties that make them dangerous in adversary hands, and this four-day raid against a nuclear regulator is the proof point the industry has been dreading.
Comments