Loading story…
Security researchers reported that suspected China-linked operators used open-source AI agent frameworks and multiple large language models to automate cyber intrusions against internet-exposed targets in Taiwan and elsewhere in Asia. Palo Alto Networks Unit 42 said a Chinese-speaking actor tracked as "knaithe" and "KnYuan" used Hermes Agent connected to a DeepSeek model to perform reconnaissance, vulnerability research, and parts of exploitation, while also falling back to manual exploitation when autonomous attempts failed. The actor also tested other Chinese and Western models, including Qwen, GLM, Kimi, MiniMax, Claude Code, and OpenAI Codex, indicating active evaluation of AI tooling for offensive operations.
Dream said a related campaign in early July used a platform built from the open-source Hermes and OpenClaw frameworks to carry out what it described as the first observed end-to-end autonomous cyberattack on a government target in Taiwan. According to the firm, the operation ran for four days, deployed up to eight agents in parallel, mapped 21 government systems, compromised at least 85 user accounts, and stole more than 2,500 personnel records before expanding to Taiwan’s nuclear safety agency, at least seven energy companies, government suppliers, and other government systems. Researchers said the activity showed AI agents can continuously adapt attack paths in real time and materially increase the speed and scale of intrusion activity, even without custom malware or highly specialized operators.
Track how attackers are adapting to this technology.
8 events from the most recent confirmed update back to the earliest known activity.
Palo Alto Networks Unit 42 published a report describing the Chinese-speaking actor's use of DeepSeek and Hermes Agent to orchestrate vulnerability exploitation and evaluate multiple AI tools for offensive operations. Researchers said the campaign demonstrated a functional end-to-end autonomous offensive workflow despite limited impact.
After the initial government intrusion, the same autonomous campaign reportedly expanded to Taiwan's nuclear safety agency, at least seven energy companies, government suppliers, and other government systems. Dream said the operators ran as many as eight autonomous agents in parallel during the operation.
Over four days in early July, attackers suspected of China links used an AI-agent platform built from Hermes and OpenClaw to map 21 Taiwanese government systems, compromise at least 85 user accounts, and steal more than 2,500 personnel records. Dream described it as the first observed end-to-end autonomous cyberattack against a government target.
Taiwan's National Security Bureau reported in January that the island had faced an average of 2.6 million Chinese cyberattacks per day during 2025. The statistic provided broader context for the later autonomous campaign described by Dream.
Taiwan’s Ministry of Digital Affairs officially confirmed an AI-assisted cyberattack targeting government agencies and described it as an abnormal incident and a world first of its kind. The confirmation concerned the July 2026 intrusion previously reported by Dream, which involved compromised government accounts and data theft.
In the same campaign, Hermes Agent autonomously attempted exploitation of CVE-2026-33017 in Langflow and CVE-2026-21858 and CVE-2025-68613 in n8n Workflow Automation. These attempts failed because target configurations disabled auto_login or required authentication.
During the Asia-focused campaign, the actor manually exploited CVE-2026-3055 on Citrix NetScaler ADC and Gateway and exfiltrated data, confirmed command execution via CVE-2026-39987 on Marimo Notebook, and attempted reverse shells via CVE-2026-34486 on Apache Tomcat and CVE-2026-33824 on Windows IKE Extensions. The actor also cloned but did not execute a proof of concept for CVE-2026-0300 affecting the PAN-OS User-ID Authentication Portal.
A Chinese-speaking threat actor using the aliases "knaithe" and "KnYuan" conducted a campaign against internet-exposed infrastructure in Asia using Hermes Agent with multiple LLMs to automate reconnaissance, vulnerability research, and parts of exploitation. The activity targeted organizations in three countries, including China and Malaysia, and had limited impact without fully compromising intended targets.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Follow how adversaries are adapting to this technology, and where it touches your stack today.
13 references tracked. Mallory keeps watching after this page renders.
theregister.com
Open sourcezdnet.fr
Open sourcescworld.com
Open sourceheise.de
Open sourceft.com
Open sourcetomshardware.com
Open sourcedreamgroup.com
Open sourceinfosecurity-magazine.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Researchers and government officials said a China-linked operation used open-source AI agent frameworks to conduct a near-autonomous intrusion campaign against Taiwan government and critical-sector organizations. The activity reportedly combined up to eight sub-agents built on **OpenClaw** and **Hermes** to automate reconnaissance, API enumeration, credential theft, vulnerability validation, lateral movement, persistence, and data exfiltration across 12 attack waves. Taiwan’s Ministry of Digital Affairs disclosed abnormal attacks with overseas origins, while reporting tied the campaign to compromises of 85 employee accounts, theft of roughly 2,500 personnel records, and targeting of agencies and suppliers including energy companies, a government email system, IT supply-chain vendors, and the nuclear safety sector. Separate reporting showed the same AI agent ecosystem is also being abused as a malware and credential-theft supply chain. In the **ClawHavoc** campaign, attackers poisoned more than 350 OpenClaw **ClawHub** skills disguised as legitimate tools, then used ClickFix-style lures and a fake **AuthTool** requirement to push infostealers and steal crypto wallets. Security researchers warned that autonomous agents can pair stolen credentials and session cookies with shared malicious skills, black-market exchanges, and prompt-injection techniques to bypass MFA, move laterally, and even deploy ransomware, turning widely available agent frameworks into a fast-scaling offensive platform and a new software supply-chain risk.
Aug 21, 2026
Dream reported that attackers used the open-source AI agent frameworks **Hermes** and **OpenClaw** to conduct a near-autonomous intrusion against government entities in Asia, compromising **85 employee accounts** and stealing at least **2,500 personnel records**. The campaign unfolded in **12 attack waves** and used up to **eight parallel sub-agents** to automate reconnaissance, credential attacks, API testing, data collection, and lateral movement at machine speed. The attackers reportedly mapped **21 connected government systems** and exploited multiple server-side weaknesses, including unauthenticated APIs, insecure authentication endpoints, weak token validation, and acceptance of JWTs using the `none` algorithm. Dream said the operation harvested employee identifiers from exposed APIs, used OCR-assisted password spraying, and then reused compromised credentials through an SSO bridge to reach internal systems; an archive linked to the campaign also contained internal network ranges, **seven SSO client secrets**, and **six database credentials**. The operator was not identified, but Dream observed Chinese-language indicators in the activity, while public reporting linked the targets to Taiwan.
Aug 25, 2026
Palo Alto Networks Unit 42 reported that a Chinese-speaking threat actor used an AI-enabled offensive workflow built around **Hermes Agent** and the **DeepSeek** model to autonomously scan the internet, identify vulnerable systems, evaluate exploit paths, and launch attacks against exposed services. The activity initially targeted **Langflow** instances and later shifted to **n8n** servers after unsuccessful exploitation attempts, showing a repeatable machine-driven cycle of reconnaissance, exploit research, and attack execution with limited human intervention. Researchers said the campaign did not achieve full compromise through the autonomous workflow alone, but the same actor also conducted manual intrusions that successfully exploited **Citrix NetScaler** devices, obtained command execution on **Marimo** notebook instances, and attempted reverse-shell access against **Apache Tomcat** and VPN targets. Unit 42 gained rare visibility into the operation after Hermes accidentally exposed the operator’s home directory through a public HTTP file server, revealing scripts, target lists, API settings, shell history, and autonomous session logs that showed AI-assisted cyberattacks are already operationally viable against internet-facing infrastructure.
Aug 4, 2026