AI Agent Swarm Breached Asian Government Systems and Stole Personnel Records

Dream reported that attackers used the open-source AI agent frameworks Hermes and OpenClaw to conduct a near-autonomous intrusion against government entities in Asia, compromising 85 employee accounts and stealing at least 2,500 personnel records. The campaign unfolded in 12 attack waves and used up to eight parallel sub-agents to automate reconnaissance, credential attacks, API testing, data collection, and lateral movement at machine speed.

The attackers reportedly mapped 21 connected government systems and exploited multiple server-side weaknesses, including unauthenticated APIs, insecure authentication endpoints, weak token validation, and acceptance of JWTs using the none algorithm. Dream said the operation harvested employee identifiers from exposed APIs, used OCR-assisted password spraying, and then reused compromised credentials through an SSO bridge to reach internal systems; an archive linked to the campaign also contained internal network ranges, seven SSO client secrets, and six database credentials. The operator was not identified, but Dream observed Chinese-language indicators in the activity, while public reporting linked the targets to Taiwan.