In early July 2026, a sophisticated cyber campaign driven by AI agents struck government systems in Asia, breaching 85 employee accounts and exfiltrating over 2,500 personnel records. That’s what researchers discovered after uncovering a 160 MB data archive containing 1,395 files related to the attack. The operation unfolded over 12 waves between July 1 and July 4. The victims are identified broadly as government entities, with some reports pointing to Taiwan; evidence in the thieves’ documentation—written in both Simplified and Traditional Chinese—suggests a Chinese-language operator.
How the Attack Unfolded
The attack leveraged open-source AI agent frameworks, notably Hermes and OpenClaw, orchestrating up to eight sub-agents working in parallel. Their tasks included reconnaissance, credential attacks, API scanning, data harvesting, and sideways movement through internal systems.
It began with agents downloading JavaScript bundles from a government portal and extracting critical info like API endpoints, OAuth client IDs, Keycloak configuration, and authentication details. This information exposed a large connected infrastructure of 21 systems tied to government single sign-on (SSO). One system alone revealed more than 36 public API endpoints handling user data, account management, and administration. Some endpoints didn’t require authentication, enabling agents to lift employee names, departments, user IDs and even SSO tokens and SDK examples.
Exploitation and Data Theft
Server-side vulnerabilities proved most critical. Weak API authentication, improper token validation, and endpoints accepting manipulated JWT tokens allowed attackers to forge credentials. Using unauthenticated APIs, agents identified valid employee usernames, then ran automated password-spraying attacks, solved CAPTCHAs via optical character recognition, and cracked 85 accounts.
Of those compromised, 84 were able to access internal systems through SSO bridges—representing a 98.8 percent success rate—granting entry to internal dashboards, equipment management tools, and personnel data. The attackers also attempted to upload a web shell via an unrestricted file-upload endpoint, but a secondary authentication hurdle blocked execution.
In total, the attackers exfiltrated 2,564 records: 1,409 employee profiles, 916 user records from exposed APIs, and 239 legal and professional records accessed via a Ministry of Justice endpoint. The haul also included internal network maps, seven SSO client secrets, and six database credentials. Their methodology included feedback loops—after each of the 12 waves they ranked possible attack paths using Bayesian scoring, ran “learning cycles” to research new vulnerabilities when earlier techniques failed, and pruned false positives (e.g. mistaking SMTP timeout errors for SQL injection bugs).
Key Weaknesses Revealed
The operation exploited several systemic gaps: exposed and unauthenticated APIs, misconfigured authentication endpoints, acceptance of unsafe JWT tokens, poor SSO trust relationships, and public-facing debugging or SDK endpoints. Servers sometimes failed to validate credentials entirely; in one case an API accepted JWTs using the “none” algorithm, letting attackers bypass token signing altogether.
Researchers warn that such AI-driven attacks are rising: not just automated scans, but full intrusions combining credential cracking, lateral movement, and data exfiltration in rapid sequence. Defenders are urged to prioritize securing all API endpoints—especially those managing accounts—strictly validate tokens, limit exposed SSO configurations, enforce strong credential protections like rate-limiting and adaptive MFA, and remove or lock down any public SDK or debugging interfaces.
What this reveals is how emerging tools can compress stages of an attack once separated by hours or days into seconds or minutes. As AI agent frameworks grow more capable, the threshold for performing large-scale, multi-step breaches drops. Going forward, security teams must assume adversaries are already stitching reconnaissance, credential abuse, exploitation, and exfiltration into unified, fast-moving systems. The pace of defense must match that of attack—or risk falling behind permanently.
