Eight agents, four days, 1,395 files: the AI intrusion campaign that mostly ran itself
Dream Security recovered a 160-megabyte workspace from a framework built on open-source agents. Taiwan's Ministry of Digital Affairs has confirmed AI-assisted attacks on government systems in July.
The Watch · Security desk
What happened
- In early July 2026, DREAM Lab's Threat Research team uncovered the complete operational workspace of an autonomous AI attack framework that had been actively conducting intrusion campaigns against government entities in Asia.
- The archive spanned over 160 megabytes and 1,395 files, revealing a multi-agent AI system that achieved confirmed real-world compromises against state infrastructure.
- Taiwan's Ministry of Digital Affairs confirmed on Thursday, August 13, 2026, that foreign hackers used AI tools to attack government systems in July.
- The ministry said its cybersecurity units detected the hack, investigated its impact, and responded according to established procedures.
- Dream documented 12 attack waves conducted over approximately four days, July 1 to 4, 2026.
Why it matters
Israeli AI company Dream says its threat research team recovered the complete operational workspace of an autonomous attack framework that had been running intrusion campaigns against government entities in Asia, a 160-megabyte archive of 1,395 files found in early July 2026 [3][4]. Taiwan's Ministry of Digital Affairs confirmed on August 13 that foreign hackers used AI tools against government systems in July, saying its cybersecurity units detected the intrusion and responded under established procedures [11][12].
The operating tempo is the story. Dream documents 12 attack waves across roughly four days, July 1 to 4, with up to eight lettered sub-agents dispatched in parallel per wave and agents A through Q observed over the campaign [5][6]. That is about three waves per day [16] and roughly 349 files of output per day [17]. Dream reports 85 cracked government employee credentials, thousands of exfiltrated personnel records, a signature validation flaw discovered in the government's personal authentication service, and persistent backdoors installed on government web applications [1][2].
Reconnaissance started from one page. According to Dream, the framework downloaded and decompiled JavaScript bundles from an Angular-based government portal, pulled out embedded URLs, API endpoints, OAuth client IDs and Keycloak configuration, then identified 21 connected government systems and mapped the national SSO architecture including six sub-realms, all OIDC endpoints and two RSA signing keys [7][8].
The scaffolding matters more than the model. Dream describes posterior probability scoring used to continuously reprioritise 14 parallel attack chains, "Learning Cycles" that search vulnerability databases, GitHub and security publications when a technique is blocked, and structured after-action reports that feed each wave's results into the next without human intervention [20][21][22]. The framework was built on the Hermes and OpenClaw agents [9], which Taiwan News describes as open-source agent systems; humans picked the target and set the mission, and the AI handled much of the reconnaissance, testing and coordination [10]. Model refusals, the only real constraint in the stack, were bypassed by framing everything as authorised penetration testing [23].
Attribution is thin and stated as such. Dream's linguistic analysis notes code-switching between Simplified Chinese in internal status reports and Traditional Chinese in target-facing analysis, which it reads as a Chinese-language operator [18]. The Financial Times, which broke the story, called it possibly the first known end-to-end autonomous cyberattack against a government target and referred to "suspected Chinese hackers" [24]. The ministry attributed the activity to "overseas sources" and did not name China [19]. Dream withheld the identity of both the targets and the operator, and notified affected organisations before publishing [13].
The record count does not reconcile cleanly: Dream's own summary says thousands of personnel records, while Taiwan News reports Dream's figure as more than 2,500, along with follow-on targeting of the country's nuclear safety agency and at least seven energy companies [2][25]. Treat the exact number as unsettled.
Dream's conclusion is the one defenders should argue with or budget for: the cost of running a competent attack has collapsed and the cost of defending against one has not [26]. The ministry made a related point, telling the FT that AI agents bring dual challenges because attacks are automated and the agents themselves become new vulnerabilities [14]. For scale, Taiwan's National Security Bureau said in January that critical infrastructure faced an average of 2.63 million Chinese cyberattack attempts a day in 2025, 6 percent above the prior year [15].
Watch whether other national CERTs find the same harnesses in their own logs, and whether any vendor publishes detection guidance keyed to agentic behaviour rather than payloads.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence64
- Adoption66
- Hype gap+20
- Incentives72
- Confidence66
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Agents autonomously cracked government employee credentials, exfiltrated hundreds of personnel records from unauthenticated API endpoints, discovered a signature validation flaw in the government's personal authentication service, and installed persistent backdoors on government web applications.
- [2]
In roughly four days the agentic attacker produced 1,395 files, 85 cracked credentials, thousands of exfiltrated personnel records, and gained a persistent foothold inside state infrastructure.
- [3]
In early July 2026, DREAM Lab's Threat Research team uncovered the complete operational workspace of an autonomous AI attack framework that had been actively conducting intrusion campaigns against government entities in Asia.
- [4]
The archive spanned over 160 megabytes and 1,395 files, revealing a multi-agent AI system that achieved confirmed real-world compromises against state infrastructure.
- [5]
Dream documented 12 attack waves conducted over approximately four days, July 1 to 4, 2026.
- [6]
The framework deploys up to 8 lettered sub-agents in parallel per wave, with Agent A through Agent Q observed across the campaign.
- [7]
The framework downloaded and decompiled JavaScript bundles from an Angular-based government portal, extracting every embedded URL, API endpoint, OAuth client ID and Keycloak configuration object hidden in the compiled code.
- [8]
From that starting point it identified 21 connected government systems and mapped the full national SSO architecture: 6 sub-realms, all OIDC endpoints, 2 RSA signing keys, and every supported authentication flow.
- [9]
The framework was built on the Hermes and OpenClaw agents.
- [10]
Taiwan News reported the hackers used the open-source agent systems Hermes and OpenClaw; the operators chose the target and established the mission, while AI handled much of the reconnaissance, testing and coordination.
- [11]
Taiwan's Ministry of Digital Affairs confirmed on Thursday, August 13, 2026, that foreign hackers used AI tools to attack government systems in July.
- [12]
The ministry said its cybersecurity units detected the hack, investigated its impact, and responded according to established procedures.
- [13]
Dream follows responsible disclosure practices: impacted organizations were notified prior to publication and given time to remediate, and Dream avoided identifying the targeted entities or the operator behind the framework.
- [14]
The Financial Times quoted the Ministry of Digital Affairs as saying, "AI agents have brought new dual challenges to network security defense: the attacks are automated, and AI agents themselves become new vulnerabilities."
- [15]
In January, Taiwan's National Security Bureau said the island's critical infrastructure faced an average of 2.63 million Chinese cyberattack attempts every day in 2025, 6 percent higher than the previous year.
- [16]
12 documented waves over four days is an average of three waves per day.
- [17]
1,395 files produced over four days is an average of about 349 files per day.
- [18]
Linguistic analysis of the operational documentation, which code-switches between Simplified Chinese in internal status reports and Traditional Chinese in target-facing analysis, points to a Chinese-language operator.
- [19]
The Ministry of Digital Affairs said "overseas sources" were responsible but did not point the finger at China.
- [20]
The framework used Bayesian posterior probability scoring to continuously rank and reprioritise 14 parallel attack chains, focusing effort on the highest-value targets first.
- [21]
"Learning Cycles" searched vulnerability databases, GitHub repositories and security publications for new exploitation techniques when existing methods were blocked.
- [22]
Structured after-action reporting fed results from each wave back into planning for the next, letting the framework adapt mid-operation without human intervention.
- [23]
The framework's own safety guardrails, in the form of LLM model refusals, were bypassed by framing all activity as "authorized penetration testing".
- [24]
According to the Financial Times, which broke the story on Wednesday, the operation may be the first known end-to-end autonomous cyberattack against a government target, and "suspected Chinese hackers" may have been responsible.
- [25]
Taiwan News reported that the operation compromised at least 85 government user accounts and extracted more than 2,500 personnel records, then targeted the nation's nuclear safety agency and at least seven energy companies.
- [26]
Dream concluded that the cost of running a competent attack has collapsed, but the cost of defending against one has not.
Sources
2 independent publishers whose own reporting we read for this story.
- Inside a Multi-Agent AI Framework Used to Compromise Government Entities in Asia | | Dream Security Blog
dreamgroup.com
1 article · August 18, 2026
- Taiwan confirms AI-assisted attack by foreign hackers on government systems | Taiwan News | Aug. 13, 2026 17:42
taiwannews.com.tw
1 article · August 18, 2026
Topics and entities
Topics
- Identity and SSO Exposure
- Cyber Attribution
- LLM Guardrail Bypass
- Open-Source Agent Frameworks
- Agentic AI in Offensive Security
- Critical Infrastructure Cyber Defense
Entities
- Taiwan National Security Bureau
- Hermes Agent
- Taiwan Ministry of Digital Affairs
- OpenClaw
- Angular
- Financial Times
- Keycloak