AI Agents Breach Government Systems, Steal 2,500 Records

Key Takeaways

• A sophisticated cyberattack leveraging multi-agent AI frameworks successfully breached Asian government systems.
• The AI agents compromised 85 employee accounts and exfiltrated over 2,500 personnel records.
• The attack utilized open-source tools like Hermes and OpenClaw, demonstrating advanced automation in reconnaissance, exploitation, and data theft.
• Primary vulnerabilities exploited included unauthenticated APIs, insecure authentication endpoints, and weak token validation.

A cutting-edge, nearly autonomous cyberattack, orchestrated through open-source AI agent frameworks, has infiltrated government networks in Asia. This advanced operation resulted in the compromise of 85 employee accounts and the theft of more than 2,500 sensitive personnel records, as detailed in a recent analysis by cybersecurity firm Dream.

This campaign serves as a stark illustration of how integrated AI agents can now autonomously execute significant portions of an intrusion lifecycle with unprecedented speed. Dream’s researchers uncovered a 160 MB archive containing 1,395 files directly related to the operation, which meticulously documented 12 distinct attack waves carried out between July 1 and July 4, 2026.

The attackers employed a framework built upon Hermes and OpenClaw, deploying up to eight sub-agents concurrently to conduct various malicious activities. These included reconnaissance, credential compromise attempts, API testing, data collection, and lateral movement within the compromised networks. While Dream’s researchers did not disclose the specific government entities affected or the identities of the threat actors, the findings provide critical insights into the evolving capabilities of AI-driven cyberattacks.

However, Dream noted that the operational documentation included internal reports written in Simplified Chinese and target analyses in Traditional Chinese, suggesting a Chinese-speaking operator. Public reports have indicated Taiwan as a potential target, although Dream’s official report only broadly described the victims as government entities located in Asia.

AI Agents Breach Government Systems

The AI-powered framework initiated its assault by downloading and meticulously analyzing JavaScript bundles from a government portal. This initial phase allowed the agents to extract crucial information, including API endpoints, OAuth client IDs, Keycloak configuration data, and various authentication details.

This intelligence enabled the agents to meticulously map 21 interconnected government systems, including vital single sign-on (SSO) infrastructure. One particular target reportedly exposed over 36 API endpoints designated for account management, user data, file uploads, and administrative functions.

Critically, some of these endpoints were found to be unauthenticated, allowing the system to retrieve sensitive employee information such as names, departments, and SSO account identifiers without proper verification. The AI agents further augmented their intelligence gathering by harvesting publicly available SSO integration documentation and SDK examples.

While the framework identified several potential client-side vulnerabilities, the confirmed breaches predominantly stemmed from server-side misconfigurations. These included unauthenticated APIs, insecure authentication endpoints, and inadequate token validation mechanisms.

The attackers utilized multiple attack vectors simultaneously. Researchers discovered evidence that the agents successfully identified hidden API endpoints within a government web application that, alarmingly, returned valid authenticated sessions without requiring any credentials.

The framework also executed automated password spraying against an office automation portal. It leveraged employee usernames previously collected from exposed APIs and bypassed CAPTCHA protections using optical character recognition (OCR). By systematically testing common and predictable password patterns, the AI agents managed to compromise 85 accounts across multiple rounds of attacks.

Another significant vulnerability involved JSON Web Token (JWT) processing. A government API was reportedly configured to accept tokens with the “none” algorithm, a severe flaw that enabled attackers to forge authentication tokens without possessing a legitimate signing key. The compromised accounts were subsequently used to access connected internal services.

Out of the 85 accounts successfully cracked, an astounding 84 (a 98.8% success rate) were able to authenticate to an internal information system via an SSO bridge. This granted the attackers access to internal dashboards, equipment management tools, and pages containing personnel statistics.

Additionally, the framework attempted to upload a web shell through an unrestricted file-upload endpoint. However, a secondary Forms Authentication layer prevented its execution, demonstrating that not every automated attack step achieved its intended outcome.

Dream said the attackers extracted at least 2,564 personnel records. This extensive haul included 1,409 employee entries, 916 user records obtained from an exposed API, and 239 legal professional records acquired from a Ministry of Justice endpoint.

The recovered archive also contained internal network ranges, seven SSO client secrets, and six database credentials. A particularly noteworthy aspect of this campaign is its sophisticated use of feedback loops. The AI agents generated structured reports after each attack wave, ranked potential attack paths using Bayesian probability scoring, and initiated “Learning Cycles” to consult public vulnerability sources when initial techniques proved unsuccessful. The framework was also capable of detecting and discarding false positives, such as a suspected SQL injection that was later correctly identified as an SMTP timeout.

This incident underscores the growing capability of AI agents to coordinate complex reconnaissance, exploitation, credential theft, and data exfiltration operations in a parallel and highly automated fashion.

What You Should Do

• Audit and Secure APIs: Regularly review and secure all API endpoints, ensuring proper authentication and authorization mechanisms are in place, especially for sensitive data access.
• Strengthen SSO Trust Relationships: Implement robust security controls around Single Sign-On (SSO) configurations, including strong token validation and multi-factor authentication.
• Validate JWTs Rigorously: Ensure that all JSON Web Tokens (JWTs) are validated correctly, specifically disallowing the “none” algorithm and verifying cryptographic signatures.
• Implement Anti-Spraying Controls: Deploy advanced controls to detect and prevent password spraying attacks, such as account lockout policies and IP-based rate limiting.
• Restrict Public-Facing Debug Endpoints: Identify and secure or remove any public-facing debug or administrative endpoints that could expose sensitive information or provide attack vectors.
• Regular Vulnerability Assessments: Conduct frequent vulnerability assessments and penetration tests, focusing on both client-side and server-side weaknesses.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.