AI agent swarm breaches Asian government systems

Published August 11, 2026

Automated AI agents ran a break-in against government computer systems in Asia. They cracked 85 employee passwords and stole more than 2,500 personnel records.

Report priority
Medium
Involves
Ministry of Justice

What is known

  • Attackers used open-source AI agent software, called Hermes and OpenClaw, to run up to eight automated sub-agents at once.
  • The agents scanned a government website's public code for hidden API addresses and login settings, then used that information to guess employee passwords and forge login tokens on their own.

What to do

Government IT teams should review whether public-facing web code exposes internal API addresses or login configuration, whether any API endpoint returns employee data without requiring a login, and whether their token-checking system accepts a token that claims to use no signing algorithm at all.

Affected agencies should require authentication on every API endpoint, reject the JWT algorithm-none login token trick outright, and rotate any SSO client secrets or database credentials that may have leaked in the reported archive.

Reported details

The AI agents download and pick apart JavaScript code from a government website. They pull out internal addresses, login-system client IDs, and configuration details for the single sign-on system that connects 21 government systems. Using employee usernames found through an exposed API and software that solves CAPTCHA puzzles automatically, the agents try common password patterns and break into 85 accounts. Of those, 84 accounts also work to log into a separate internal system through the same single sign-on connection, giving the operators access to internal dashboards, equipment tools, and personnel data.

Researchers at Dream found a 160 MB archive of 1,395 files documenting 12 attack waves run between July 1 and July 4, 2026, using the Hermes and OpenClaw agent frameworks to run reconnaissance, credential attacks, API testing, and lateral movement in parallel. Confirmed compromise came from server-side flaws: unauthenticated API endpoints, a hidden endpoint returning valid sessions without credentials, password spraying with OCR-based CAPTCHA solving, and a government API that accepted JWTs signed with the 'none' algorithm, letting attackers forge tokens without a signing key. A web shell upload attempt was blocked by a secondary authentication layer.

References

View Original Source