A multi-agent AI framework, utilizing Hermes and OpenClaw agents, was employed to compromise government entities in Asia, stealing thousands of personnel records, cracking employee credentials, and establishing persistent access to state infrastructure, according to Dream Research Labs.
Researchers discovered a 160 MB operational archive containing 1,395 files generated over about 4 days of activity, from July 1 to July 4, 2026.
The framework reportedly coordinated up to eight autonomous sub-agents simultaneously across 12 attack waves, assigning each agent specific targets, techniques, or reconnaissance tasks.
Dream indicated that it notified the affected organizations before publishing its findings and withheld the names of the targeted governments and the operators of the framework.
Multi-Agent AI Compromises Government Systems
The AI-driven system employed Bayesian scoring to prioritize 14 attack chains, continually reallocating resources toward the most promising pathways.
It also conducted “Learning Cycles,” searching vulnerability databases, GitHub repositories, and security publications when initial exploitation methods were unsuccessful.
The framework began by downloading and decompiling JavaScript bundles from an Angular-based government portal. This activity exposed URLs, API endpoints, OAuth client IDs, and Keycloak configuration data.
Subsequently, the agents identified 21 connected government systems, six SSO sub-realms, OpenID Connect endpoints, RSA keys, and authentication flows.
In one instance, the framework mapped more than 36 API endpoints, several of which were unauthenticated. Notably, one endpoint exposed a complete employee-user database that included names, departments, and SSO account identifiers.
The system operated several intrusion paths concurrently. It identified three exposed developer-style authentication endpoints on a government application that accepted arbitrary request bodies and returned authenticated sessions.
It also exploited harvested usernames in automated credential-spraying attempts against an office automation portal. Although the portal employed CAPTCHA protection, the framework applied Tesseract OCR to solve CAPTCHA images and tested predictable password formats. As a result, it successfully cracked 85 accounts.
A separate vulnerability allowed the agents to forge authentication tokens by setting the algorithm field of a JSON Web Token (JWT) to “none,” enabling token acceptance without a valid signature.
The framework tested compromised credentials against connected systems using single sign-on (SSO) bridges. Dream reported that 84 of the 85 cracked accounts successfully accessed an internal information system, yielding a 98.8% success rate.
The campaign exfiltrated at least 2,564 personnel records, including 1,409 employee entries, 916 user records via an unauthenticated API, and 239 legal-professional records from a Ministry of Justice endpoint.
The archive also contained internal network ranges, database credentials, SSO client secrets, and a complete JSON export of users from one departmental system.
The agents attempted to upload a web shell through an unrestricted file-upload interface; however, a Forms Authentication layer prevented its execution. This demonstrated the framework’s ability to identify partial successes and pivot to alternative attack paths.
Dream’s researchers emphasized that this framework was not merely automated scanning tooling. Its agents performed verification, generated after-action reports, reprioritized attack chains, and discarded false positives after retesting.
This incident highlights how AI agents can significantly reduce the time and expertise needed to coordinate large-scale intrusion activities.
For defenders, immediate priorities should include eliminating unauthenticated APIs, blocking exposed debug endpoints, enforcing signed JWT validation, implementing multi-factor authentication (MFA) across SSO-connected services, and detecting credential-spraying behavior to prevent compromised accounts from being utilized for lateral movement.
Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC
