AI Agents Breach Asian Government Systems, Crack 85 Accounts and Steal 2,564 Records

A suspected near-autonomous cyber intrusion campaign compromised government entities in Asia and demonstrated how multi-agent artificial intelligence can automate large portions of a sophisticated attack chain.

According to Dream Research Labs, the operation ran for approximately four days in July 2026, compromising 85 employee accounts and extracting at least 2,564 personnel records.

The research was published on August 12 and described an operational archive containing 1,395 files documenting the activity.

AI Agents Breach Asian Government Systems

The campaign reportedly relied on the Hermes and OpenClaw agent frameworks, with as many as eight sub-agents operating concurrently during individual attack waves.

Across 12 waves, the agents performed reconnaissance, credential attacks, lateral movement, data collection, vulnerability investigation, and persistence attempts.

The activity illustrates a shift from AI being used as an individual hacking assistant toward AI agents being orchestrated as specialized components of a broader offensive workflow.

During reconnaissance, the agents reportedly decompiled Angular JavaScript bundles, identified 21 connected systems, mapped OIDC and Keycloak configurations, and discovered more than 36 API endpoints on one target.

Several exposed APIs allegedly returned employee information without authentication, including names, departments, and SSO identifiers. The attackers then used the collected information to improve password-spraying attempts against employee accounts.

The credential attacks combined predictable password patterns with automated processing and Tesseract OCR to overcome small CAPTCHA challenges.

Dream reported that the operation initially compromised 12 accounts before expanding its password-pattern strategy and obtaining access to 73 additional accounts.

The campaign ultimately reached 85 compromised employee accounts, demonstrating how automated feedback loops can allow an attack framework to refine its approach as new information becomes available.

Authentication weaknesses further expanded the attack surface. Researchers identified three exposed debug-style authentication endpoints that reportedly issued valid sessions.

The framework also encountered a JWT validation weakness in which tokens using the none algorithm were accepted. Of the compromised accounts, 84 reportedly authenticated through an SSO bridge into an internal information system, producing a 98.8 percent pivot rate.

This enabled the operation to move beyond individual employee accounts into connected government applications.The data exposure was substantial. Dream reported obtaining 1,409 employee records, 916 additional records through an unauthenticated API, and 239 legal-professional records associated with a Ministry of Justice endpoint.

The archive also reportedly contained a complete JSON user export, seven SSO client secrets that had already been rotated, six database credentials, and internal network ranges.

An unrestricted file-upload function was also abused to upload a web shell, although an additional Forms Authentication layer prevented execution and kept the attempted remote-code-execution scenario from being confirmed.

One of the campaign’s notable characteristics was its decision-making system. Dream described a two-layer Bayesian prioritization mechanism in which findings began with an initial probability and were subsequently promoted or discarded based on tool results, confirmation, impact analysis, and evidence that could block exploitation.

Five documented learning cycles searched public vulnerability resources and code repositories when an approach failed, while after-action reports influenced subsequent attack waves.

The framework also reportedly rejected seven false positives, including an apparent time-based SQL injection that was ultimately attributed to an SMTP timeout.

This capability highlights the importance of orchestration: the security concern is not simply that an AI model can generate attack instructions, but that multiple agents can continuously investigate, validate, prioritize, and adapt their actions with limited human intervention.

Although reporting has linked the campaign to Taiwan and suggested possible China-linked activity, Dream did not formally attribute the operation to a specific threat group.

Taiwan’s authorities separately confirmed that government agencies had been targeted by AI-assisted attacks originating overseas.

For defenders, the campaign highlights several immediate priorities: eliminate unauthenticated APIs, remove production debug endpoints, enforce robust JWT validation, strengthen SSO trust boundaries, require phishing-resistant MFA where possible, and implement effective password-spraying protections.

Organizations should also continuously monitor identity telemetry, API access patterns, unusual authentication sequences, and attempts to upload executable content.

The incident demonstrates that securing individual vulnerabilities is no longer enough; defenders must evaluate how exposed identities, APIs, authentication systems, and cloud-connected applications can be automatically chained together by increasingly capable AI-driven intrusion frameworks.