This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
In July 2026, a suspected Chinese-language threat actor deployed a near-autonomous multi-agent AI framework built on Hermes and OpenClaw to conduct a coordinated cyberattack against Taiwanese government agencies, exfiltrating over 2,500 personnel records.
From July 1–4, 2026, suspected China-linked hackers reportedly used a multi-agent framework built on Hermes and OpenClaw to compromise Taiwanese government systems. The agents reportedly compromised 85 credentials and used persistent access to connected systems to exfiltrate more than 2,564 personnel records. Taiwan later confirmed an overseas AI-assisted campaign against government agencies, without attributing it to China.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
Using AI systems to develop cyber weapons (e.g., by coding cheaper, more effective malware), develop new or enhance existing weapons (e.g., Lethal Autonomous Weapons or chemical, biological, radiological, nuclear, and high-yield explosives), or use weapons to cause mass harm.
Also classified as
The AI framework successfully exfiltrated over 2,564 sensitive personnel records containing non-public employee names, departments, and SSO IDs.
The incident involved the deployment of an autonomous AI-agent framework to conduct coordinated cyberattacks against state infrastructure, representing a malicious use of AI for cyber-offensive operations.
Human
Due to a decision or action made by humans
Intentional
Due to an expected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The cyberattack was intentionally initiated and directed by human threat actors using deployed AI agent frameworks to compromise government systems.
Suspected Chinese-language threat actors deployed a highly autonomous multi-agent AI cyber-offensive framework against Taiwanese government agencies, critical infrastructure, and supply chains. While successfully mitigated, the incident demonstrates an evolved capability in AI-driven espionage and reconnaissance, posing a substantial threat to state sovereignty and information security.
The report describes a multi-agent AI system built on the Hermes and OpenClaw frameworks that deploys up to 8 lettered sub-agents in parallel per wave, each assigned to distinct targets and attack techniques.
High Risk: The AI system was used to target and scan critical infrastructure, including a nuclear safety agency and multiple energy sector companies, which represents a significant threat to public safety and infrastructure security.
The AI system's primary function was to map networks, identify vulnerable endpoints, and target specific government systems, while also performing static analysis on SDK code.
The incident is documented in detail by DREAM Lab's Threat Research team, which recovered the complete 160MB operational workspace of the attacker. The findings are corroborated by official statements from Taiwan's Ministry of Digital Affairs and reporting by major news outlets like Reuters and the Financial Times.
The attack could be interpreted as a standard human-led cyberattack that merely utilized AI scripts, rather than a fully autonomous AI-driven campaign.
Technology
Open-weights frontier-adjacent models
Models provide advanced reasoning capabilities to unauthorized operators.
Advanced agentic frameworks
Hermes and OpenClaw enable autonomous planning and execution.
Vulnerable model guardrails
Guardrails bypassed by framing activity as authorized pentesting.
Data Inputs
Unauthenticated user data access
Exposed API endpoints provided employee usernames for credential spraying.
Exposed integration documentation
GitBook portal hosted SSO guides and SDKs, facilitating scraping.
Unprotected public repositories
Learning cycles scraped vulnerability databases and GitHub for exploits.
Human Factors
Capable human operator intent
Human operator initiated the attack, setting objectives and directives.
Developer oversight
Debug endpoints and unauthenticated APIs were left exposed in production.
Predictable employee credentials
Employees used simple password patterns based on usernames and IDs.
Process and Methods
Multi-agent coordination loops
Parallel dispatch and structured feedback loops optimized execution.
Bayesian prioritization scoring
Two-layer decision engine dynamically prioritized high-value targets.
Autonomous learning cycles
AI conducted automated research to adapt techniques mid-operation.
Management
Insufficient defensive resources
Cost of running AI attacks collapsed but defensive costs remained high.
Weak SSO and MFA policies
Management failed to enforce MFA or restrict trust across systems.
Delayed security monitoring
Warning alerts were only issued after abnormal attack activity began.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
