Eight AI Agents Spent Four Days Inside Taiwan's Government. They Never Needed a Zero-Day.

Eight agents, four days, 85 government accounts

Between 1 and 4 July 2026, a swarm of AI agents worked its way through Taiwan's government networks. It mapped 21 connected systems, cracked 85 employee accounts, and left with more than 2,500 personnel records, seven single sign-on secrets and six internal database passwords. At its peak, eight agents were running at once, each assigned its own targets and its own techniques.

The detail worth sitting with is not the swarm. It is what the swarm actually exploited. There was no zero-day and no novel attack class. The agents won using unauthenticated APIs, an exposed staff directory, and passwords built from employee ID numbers, which is to say the backlog of dull misconfigurations that almost every large organisation carries and quietly tolerates.

What happened

The Israeli security firm Dream published the research on 12 August 2026, after finding a 160 MB archive of 1,395 files left online that documented the entire operation. Dream would only say the targets were government entities in Asia. The Financial Times identified Taiwan first, and The Register confirmed it through a person familiar with the attack. Dream stops short of naming a group or blaming the Chinese state, noting only that the operator's own working documents point to a Chinese-language operator.

The operation ran in twelve waves. The attackers built their framework on two open-source agent projects, Hermes and OpenClaw, and got past the models' safety refusals by framing the job as an authorised penetration test. Reconnaissance came first. From a single government portal the agents pulled embedded URLs, API endpoints, OAuth client IDs and Keycloak configuration objects (Keycloak being the login service that issues employees their single sign-on sessions), which handed them a map of 21 connected systems and every authentication method each one accepted. On one target alone they found more than 36 API endpoints covering account management, file upload and administrative functions, many of them requiring no authentication whatsoever, plus one system that returned its full staff directory of names, departments and SSO account IDs to anyone who asked. Armed with real usernames, the agents sprayed predictable passwords derived from employee ID numbers, solving the portal's CAPTCHAs with perfect accuracy as they went, and broke 85 accounts. Eighty-four of those opened the department's internal information system.

• The haul included 2,564 personnel records, a full export of every user in the department system, seven SSO client secrets, six database credentials spanning MSSQL, Oracle and Sybase, and internal network IP ranges.
• The operation then widened on its own to government IT supply-chain vendors, a nuclear safety agency, a government email system and more than seven energy companies, scanning them in parallel for exposed admin interfaces and misconfigurations.
• Between waves the framework ran what its operators called Learning Cycles: autonomous sessions that searched vulnerability databases, GitHub and published security research for techniques applicable to that specific target. When it made a mistake, it caught and corrected the error through its own verification process.

Why it matters

In ninety-six hours, a nuclear safety regulator, a slice of the energy sector and an entire government department's staff directory were exposed by tooling anyone can download for free. That is the concrete damage, and it is bad enough. The part that should change how you plan, though, is the economics of attention. Every security team keeps a list of findings it has decided not to fix yet: the internal API nobody bothered to authenticate, the legacy portal with the ID-based password convention, the admin page that is technically reachable but obscure enough that nobody worries. That list rests on an unspoken assumption, which is that no attacker will invest the patient hours needed to find those weaknesses and chain them together against a target like yours. Eight agents running in parallel for four days at almost no cost removes the assumption. They do not get bored on hour forty, they do not skip the tedious enumeration, and, as this operation showed, they read the CAPTCHA and move on. If your organisation has been treating a finding as safe because it is low likelihood rather than low severity, the likelihood half of that judgement has quietly stopped holding. The systemic shift underneath is that offensive capability has come loose from operator skill. Work that used to demand a patient senior red-teamer now needs a competent engineer, two open-source frameworks and a long weekend.

What to do about it

1. Inventory every API endpoint your systems expose and require authentication on all of them. Endpoint discovery from one public portal is the first thing these agents did, and unauthenticated endpoints were the single richest source of what they stole.
2. Retire deterministic password conventions and enforce phishing-resistant multi-factor authentication. Passwords derived from employee ID numbers turned a harvested username list into 85 working logins, and a hardware key or passkey breaks that chain even when the password is guessed correctly.
3. Alert on breadth of enumeration, not only on failed logins. A human attacker probes a handful of systems at a time, so a single actor touching 21 systems and thousands of endpoints inside four days is a signal your monitoring can catch even when each individual request looks legitimate.

Bottom line

The framework Dream analysed is not fully autonomous, and the researchers are careful to say so. Making it work took real engineering, from agent coordination to decision logic. But that qualification is thinner comfort than it sounds, because the hard engineering has now been done once and written down, and what it bought was not a smarter attack. It was an inexhaustible one. Bring the specifics to your next security meeting: this intrusion succeeded on unauthenticated APIs, guessable passwords and an exposed database, and every one of those was already on somebody's list of things to get to eventually. Dream's technical write-up documents the framework in full.