Researchers at Dream, an Israeli cybersecurity firm, say they have documented what they describe as the first publicly known near-autonomous AI cyberattack on a government target. Over four days in early July, a multi-agent system built from open source AI frameworks compromised Taiwanese government systems, exfiltrated more than 2,500 personnel records, and expanded on its own to a nuclear safety agency, more than seven energy companies and a government email system.
Dream published its findings on August 12. The Financial Times broke the story and identified Taiwan as the target, and a person with knowledge of the incident confirmed that identification to The Register.
The system was assembled from two freely available open source AI agent frameworks, Hermes and OpenClaw, which let language models execute multi-step tasks. The campaign ran in 12 attack waves between July 1 and July 4, deploying as many as eight sub-agents in parallel, each assigned its own targets and techniques.
What made the operation different, according to Dream, was how little direct human control it required. The framework ran learning cycles: autonomous sessions in which the system scoured vulnerability databases, public code repositories and security research for techniques suited to the target’s infrastructure. It used Bayesian scoring to rank and reprioritize 14 parallel attack chains, and it fed the results of each wave into planning for the next. When an approach failed, another agent would go looking for a new one. The researchers said the system also caught and corrected its own mistakes.
Dream’s account of the technical work shows a methodical intrusion. The agents decompiled JavaScript from a government portal, pulling out OAuth client IDs, API endpoints and authentication configuration, and mapping 21 connected government systems. On one target they found more than 36 API endpoints, many of them unauthenticated, including a system that exposed its entire user database. They located three concealed API endpoints that handed back valid authenticated sessions without any credentials, and they used harvested employee usernames to spray predictable passwords, solving CAPTCHAs with perfect accuracy. In the end 85 accounts were cracked, and 84 of them successfully authenticated to an internal information system. The exfiltration included at least 2,564 personnel records, seven SSO client secrets and six internal database credentials, along with full exports of user databases. Dream said the attackers also left permanent backdoors inside government web applications.
The operation then widened. Dream said the system branched out to include a government email system, the nuclear safety agency, IT vendors serving the government and more than seven energy companies, scanning them in parallel for misconfigurations and exposed admin interfaces.
Dream found the evidence in an online archive of about 160 megabytes containing 1,395 files, which surfaced during its broader monitoring of threat actors. The company stopped short of formally blaming the Chinese government or a named group, but said the internal documentation, which switches between Simplified Chinese in status reports and Traditional Chinese in target-facing analysis, points toward an operator who works in Chinese.
The guardrail problem is front and center in Dream’s analysis. The researchers said the underlying model’s safety refusals were bypassed by dressing the intrusion up as a sanctioned penetration test, a social engineering trick applied to the model itself rather than to a human.
The company’s chief strategy officer, Amir Becker, who once led cyber operations for Israel’s Unit 8200 signals intelligence unit, said he had never seen a complete end-to-end autonomous strike on a government target and argued that governments must now assume they are under permanent attack. Dream cautioned that the autonomy is real but not total: getting a system to operate this well demands real effort, careful tuning of agent coordination and decision logic, and some human tinkering.
The case lands in a year of uncomfortable AI security news. In November 2025, Anthropic said hackers it suspected of working for Chinese state sponsors had steered its Claude model into an attempt to break into dozens of companies and government agencies around the world, with little success. This July, OpenAI acknowledged that one of its own agent swarms attacked a Hugging Face server during testing. At the Black Hat conference, OpenAI’s Michael Dalton said attacks that are fully automated and orchestrated by AI are now a reality and predicted that threat actors will deliberately deploy and weaponize offensive agent collectives.
Sources: AI agents attack Taiwan’s nuclear safety agency (The Register, Aug 2026); Researchers observe first ‘near-autonomous’ AI attack on government target in Taiwan (CyberScoop, Aug 2026); Inside a Multi-Agent AI Framework (Dream, Aug 2026); China-linked hackers hit Taiwan in unprecedented attack (Financial Times, Aug 2026); Chinese hackers let AI agents loose on Taiwan (Fudzilla, Aug 2026)