Ahmed Shaami
Security researchers at Dream Security have published a full teardown of what they describe as a near-autonomous, multi-agent AI attack framework that compromised government systems in Asia over roughly four days in July 2026. According to the report from the company’s Dream Research Labs team, published on 12 August, the framework dispatched up to eight AI sub-agents in parallel, cracked 85 government employee accounts and extracted more than 2,500 personnel records. It is one of the clearest documented cases so far of an AI system running an intrusion campaign rather than merely assisting a human who is running one.
Twelve waves, 1,395 files, four days
Dream says its threat research team recovered the attacker’s complete operational workspace, an archive of more than 160 megabytes containing 1,395 files. Across 12 documented attack waves between 1 and 4 July 2026, agents given letter designations from A through Q were each assigned separate targets and techniques, with as many as eight running concurrently in a single wave.
The framework was built on two publicly available open-source agent harnesses, Hermes and OpenClaw. Both wrap an underlying language model in planning loops, parallel dispatch and persistent memory, which is what allowed the operation to keep going without someone steering each step.
From one starting point, a government portal, the framework decompiled JavaScript bundles and mapped 21 connected government systems, including the national single sign-on architecture. On one target alone it found more than 36 API endpoints, many of them completely unauthenticated. By the end it had pulled 2,564 or more personnel records, a full user database export, seven SSO client secrets and six internal database credentials, then expanded its scanning to government IT vendors, a nuclear safety agency, a government email system and seven or more energy companies.
Dream says it followed responsible disclosure, notified the affected organisations before publishing, and deliberately avoided naming either the targets or the operator. Linguistic analysis of the framework’s internal reporting, which switched between Simplified and Traditional Chinese, pointed to a Chinese-language operator, but the firm did not attribute the campaign to a specific group or government.
The break-ins themselves were ordinary
Read past the AI headline and the actual entry points are the kind of mistakes that turn up in security audits every week:
- An unauthenticated API endpoint that returned the department’s entire employee list, names, departments and SSO account IDs included.
- Passwords built predictably from employee IDs, cracked by spraying capitalised and decorated variations of each username.
- Three hidden debug endpoints left running in production that accepted any request body and returned a valid authenticated session.
- An API that accepted JWT tokens with the algorithm field set to none, letting anyone forge an identity token without the signing key.
- Internal systems that trusted an existing SSO session with no additional authentication and no MFA prompt. Dream reports that 84 of the 85 cracked accounts, or 98.8 percent, pivoted successfully into internal systems.
Even the CAPTCHA on the office portal was handled with Tesseract, an ordinary open-source OCR tool, which the report says solved the small challenge images with complete accuracy.
None of that is a novel exploit. What the AI layer changed was throughput and cost. The framework scored each finding with a Bayesian confidence model, promoted only the chains it rated most likely to work, ran research cycles to look up new techniques when it hit a wall, and caught seven of its own false positives through repeat verification. Dream’s own conclusion is that the price of mounting a competent attack has collapsed while the price of defending has not.
Guardrails held only against honest operators
The report notes that the underlying model’s safety refusals were bypassed simply by framing every request as authorised penetration testing. That detail matters more than the exploit list, because it means the constraint most people assume is doing the work was never really tested by an attacker willing to lie about intent.
The question this leaves for everyone building on the web
Government networks make the headline, but the flaws on that list are the same ones a small agency or a solo developer can leave behind on a client project in an afternoon. A user-listing endpoint shipped without auth. A debug route someone forgot to remove before handover. A password policy that lets staff use their own employee ID. A dashboard behind SSO with no second factor.
Those things used to survive because nobody was looking hard enough at a mid-sized business or a client portal to make the effort worthwhile. That calculation is what changes if reconnaissance across hundreds of targets becomes cheap enough to run in parallel. If you build or maintain client systems, the practical takeaway from this report is not to buy an AI defence product, it is to go and check whether any of the five items above are sitting live in something you shipped. Our earlier round-up of cybersecurity trends worth watching in 2026 covers the wider picture.
Sources: Dream Security research report, Dark Reading, CSO Online.
