Eight AI Agents Breach Government Systems, Crack 85 Accounts and Steal 2,500+ Records

A near-autonomous cyberattack using open-source AI agent frameworks compromised government systems in Asia, cracked 85 employee accounts, and stole more than 2,500 personnel records, according to research from Dream.

The campaign demonstrates how coordinated AI agents can now execute large parts of an intrusion operation at machine speed. Dream researchers uncovered a 160 MB archive containing 1,395 files linked to the operation. The material documented 12 attack waves conducted between July 1 and July 4, 2026.

The framework used Hermes and OpenClaw, deploying up to 8 sub-agents in parallel to perform reconnaissance, credential attacks, API testing, data collection, and lateral movement. The researchers did not identify the affected entities or the operator.

However, Dream said the operational documentation used Simplified Chinese in internal reporting and Traditional Chinese in target analysis, suggesting a Chinese-language operator. Public reporting identified Taiwan as the target, though Dream’s report described the victims only as government entities in Asia.

AI Agents Breach Government Systems

The AI-driven framework began by downloading and analyzing JavaScript bundles from a government portal. It extracted API endpoints, OAuth client IDs, Keycloak configuration data, and authentication details.

This enabled the agents to map 21 connected government systems, including single sign-on infrastructure. One target reportedly exposed more than 36 API endpoints for account management, user data, uploads, and administration.

Some endpoints were unauthenticated, allowing the system to retrieve employee information, including names, departments, and SSO account identifiers. The agents also harvested publicly available SSO integration documentation and SDK examples.

While the framework flagged several potential client-side weaknesses, the confirmed compromises were primarily caused by server-side issues, including unauthenticated APIs, insecure authentication endpoints, and weak token validation.

The campaign used several attack paths simultaneously. Researchers found evidence that the agents discovered hidden API endpoints on a government web application that returned valid authenticated sessions without requiring credentials.

The framework also conducted automated password spraying against an office automation portal. It used employee usernames collected from exposed APIs and solved CAPTCHA images with OCR. By testing predictable password patterns, the agents cracked 85 accounts across several rounds.

Another flaw involved JWT processing. A government API reportedly accepted tokens with the none algorithm, allowing attackers to forge authentication tokens without access to a signing key. The compromised accounts were then tested against connected internal services.

Of the 85 cracked accounts, 84 successfully authenticated to an internal information system through an SSO bridge, a 98.8 percent success rate. This gave the attackers access to internal dashboards, equipment management tools, and personnel statistics pages.

The framework also attempted to upload a web shell through an unrestricted file-upload endpoint. A secondary Forms Authentication layer prevented execution, showing that not every automated attack step succeeded.

Dream said the attackers extracted at least 2,564 personnel records, including 1,409 employee entries, 916 user records from an exposed API, and 239 legal-professional records from a Ministry of Justice endpoint.

The archive also included internal network ranges, 7 SSO client secrets, and 6 database credentials. What makes the campaign notable is its use of feedback loops.

The agents created structured reports after each wave, ranked attack paths using Bayesian probability scoring, and ran “Learning Cycles” to search public vulnerability sources when earlier techniques failed. The framework also detected and discarded false positives, including a suspected SQL injection later attributed to an SMTP timeout.

The incident shows that AI agents are increasingly capable of coordinating reconnaissance, exploitation, credential attacks, and data theft in parallel. Defenders need to prioritize exposed APIs, weak SSO trust relationships, JWT validation, credential-spraying controls, and public-facing debug endpoints.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Eight AI Agents Breach Government Systems, Crack 85 Accounts and Steal 2,500+ Records appeared first on Cyber Security News.