Open-source AI agents breached a government in four days. Your defenses assume a human attacker.

The account comes from Dream, an Israeli cybersecurity firm, which published its analysis on August 12 after recovering the attacker's own working files: a 160 megabyte archive of 1,395 files left exposed. The Financial Times, as reported by The Register, confirmed Taiwan as the target. Dream stops short of naming a government or a group, but says the operational documentation points to a Chinese-language operator.

Between July 1 and July 4 the framework ran 12 distinct attack waves. It was built on two freely available open-source agent platforms, Hermes and OpenClaw, and deployed up to eight sub-agents at a time, each assigned its own targets and techniques. Starting from a single government portal, the agents pulled embedded URLs, API endpoints, OAuth client IDs and configuration objects, and from that one foothold identified 21 connected government systems and every authentication flow they supported. Then they went to work: credential spraying with predictable password patterns, forged tokens where a JWT signature check could be skipped, hidden API endpoints that handed back authenticated sessions to any request. They cracked 85 accounts, and 84 of those 85 moved laterally into further systems. Along the way they lifted seven single-sign-on client secrets and six internal database credentials, and pulled 2,564 personnel records from three separate weak points. The CAPTCHAs that were supposed to slow a bot down were solved with off-the-shelf OCR at 100 percent accuracy.

The part that should change how you read this is the autonomy. When a technique failed, the framework did not stop and wait for a human. It ran what its own logs called learning cycles: it searched public vulnerability databases and code repositories for a new technique, scored its options, and retried in the same session. It caught its own false positives and re-tested findings before trusting them. A human operator picked the targets and gave strategic approval. The machine did nearly everything else.

It would be easy to file this beside the usual agent headlines, the new workbench that lets anyone build agents or the latest funding round, and scroll on. That would be a mistake. Cast back to last November, when Anthropic reported disrupting a state-linked campaign in which an AI agent ran an estimated 80 to 90 percent of the operational work across roughly thirty targets. Line the two up and the shape is hard to unsee: two documented, state-scale intrusions inside a year, each carried out mostly by software rather than a person. The forecasts have caught up with the present. At Black Hat this month an OpenAI researcher said it on the record: AI orchestrated, fully automated offensive attacks are real now.

What should hold your attention is how ordinary the techniques were. No exotic cryptographic break, no zero-day only a state could have found. The agents forged a token because an endpoint let them skip a signature check, sprayed passwords that followed a guessable pattern, and moved from one system to the next on shared SSO secrets. Each of those is a weakness a patient human might have turned up on its own over several weeks. The agents turned up all of them at once, inside four days, and never lost interest.

What turns this from a geopolitics story into a governance one is a single fact about the tooling. The attack framework was built on Hermes and OpenClaw, two open-source agent platforms that are freely downloadable and designed to let a model act autonomously on real tasks. That is not exotic nation-state kit. It is the same category of tooling your team is evaluating right now to read tickets, reconcile invoices, and answer customers.

What made the attack work is exactly what makes agents useful to you: they take a goal, plan a path, use tools, notice when something fails, and try another way without being told. Point that capability at your backlog and it clears work while you sleep. Point it at your login page and it probes every weakness you have, at the same speed, for as long as it takes. The capability is neutral. The only variable is which side of your perimeter it is running on, and the barrier to standing up the offensive version just dropped to a download.

Every outlet restated Dream's findings and the Black Hat quote. Almost none of them worked out what it changes for an organization that is deploying agents, which is this: the assumptions baked into your defenses were written for a human attacker, and a human attacker is slow, tires, and gives up. Those three properties are load-bearing, and an autonomous agent has none of them.

A CAPTCHA works because it costs a person a moment of friction and a script cannot read it. The agents read every one. Rate limits and lockouts work because a human trying passwords is a trickle you can throttle. The agents came in parallel across eight sub-agents. Blocking a technique works because it makes an attacker go away to think. The agents went away, read a vulnerability database, and came back with a new technique in the same session. A morning security review works because a human intrusion unfolds slowly enough to catch on the next shift. Twelve waves ran in four days. Every one of those controls is still worth having. What changed is that not one of them is sufficient on its own anymore, because each was quietly sized for an adversary who is no longer the one on the other end.

The governance gap this exposes already has numbers on it. A Gravitee survey of more than 900 executives and practitioners put executive confidence at 82 percent, against only 14.4 percent of organizations that send agents to production with full security sign-off. Until now that shortfall read as a story about your own agents running unwatched. It is now also the opening an outside attacker probes.

This one cuts both ways, and reading it as all threat or all opportunity would miss half of it.

Done right, this news costs you almost nothing and may even help. The controls that contain an external autonomous attacker are the same ones that keep your own agents in their lane: distinct identity per agent, credentials scoped narrow and expired fast, least privilege so nothing can reach further than its job needs, and monitoring that acts rather than reports. A team that has already put those in place to ship agents safely has, without extra work, hardened itself against the attack running the same playbook from outside. The upside is real: you keep deploying agents for the ten-times-output reasons you started, and the defensive posture you built for governance doubles as your answer to machine-speed offense.

Done wrong, this is the moment your exposure changed and your defenses did not. If your security still assumes attackers are slow enough to catch on the next shift, you are now defending human-speed walls against an adversary that reads every CAPTCHA, sprays credentials in parallel, and learns a new exploit mid-session. CrowdStrike's 2026 Threat Hunting Report, as reported by The Register, already tracks AI-agent-triggered activity at about 2.5 times the rate of human-triggered threats, and found 88 percent of exploitations using public proof-of-concept code happened within 48 hours of release. The gap between how covered you feel and how covered you are does not announce itself. It gets found, at machine speed, by something that never files a ticket.

The good news buried in a scary story is that the fixes are boring, and boring is buildable. Ordinary gaps close with ordinary controls; they just have to be sized for the new attacker rather than the old one.

Start with identity and credentials, because that is what the lateral movement ran on. Scope every secret to one system, issue it per identity, and expire it fast, so a single cracked credential is an incident rather than a skeleton key. That one change turns the 84-of-85 lateral cascade into a dead end. Then least privilege, so the reachable path is short: the agents minted their way toward admin because admin was reachable at all. Then detection that gates and acts, not detection that reports, because the human is too slow to be the first responder against twelve waves in four days. Their job is to be the escalation the automated revocation calls, after it has already pulled the credentials. And rate limiting and anomaly detection on top, because machine-speed access is itself the signal a human-speed control never had to watch for.

This is the part we care about at agentclaw, because it is the same discipline whether the agent is yours or someone else's. When we build an agent, the scoped identity, the least-privilege access and the logging that gates a launch are part of the build, not a security review bolted on after it is in production. An agent that cannot show you its own guardrails is not finished, and a perimeter that assumes a tired attacker is not defended. The controls answer both problems with the same work, which is exactly why doing it once is worth it.

Not every team should treat this as a five-alarm morning. If your systems are small, internal, and behind a corporate identity provider with sensible defaults, the direct risk from this specific class of attack is lower than the headline suggests, and the right move is to check the four controls above rather than to panic.

The teams that should read this closely are the ones exposing anything to the open internet: a login page, a public API, a customer portal, an SSO surface. That is where a parallel agent sweep pays off, and it is where the assumptions this attack broke are load-bearing. If you are in that group and you cannot answer, today, where your credentials live, how far one of them reaches, and what watches your login attempts in real time, that is the gap. It is not a new gap. It is the same gap you always had, now being probed by something a great deal faster than what you built the walls for.