InfoSecBulletin Cybersecurity for mankind
A cyberattack using open-source AI tools almost ran on its own. It affected government systems in Asia, compromised into 85 employee accounts, and took over 2,500 personal records, as per a study from Dream.
The campaign shows how AI agents can work together to carry out big chunks of a hacking job really fast. Researchers found a 160 MB file with 1,395 files related to the job. This material recorded 12 attack waves that happened from July 1 to July 4, 2026.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
The system used Hermes and OpenClaw, sending out up to 8 sub-agents at the same time to do tasks like scouting, password attacks, API testing, gathering data, and moving sideways. The researchers did not find out which entities were affected or who was behind it.
Dream mentioned that the paperwork used Simple Chinese for internal reports and Traditional Chinese for target analysis. This hints at a Chinese-speaking operator. Public reports pointed to Taiwan as the target, but Dream’s report only talked about the victims as government groups in Asia.
AI Agents Breach Government Systems
The AI system started by downloading and examining JavaScript files from a government website. It took out API links, OAuth client IDs, Keycloak setup information, and login details.
This allowed the agents to find 21 linked government systems, including a single sign-on setup. One target supposedly showed over 36 API points for managing accounts, user data, uploads, and control.
Some points in the system did not need a password, letting it get employee details like names, departments, and SSO account IDs. The agents also collected public SSO integration guides and SDK examples.
The framework found some possible client-side flaws, but the confirmed issues mainly came from server-side flaws. These included APIs that didn’t need authentication, insecure login points, and weak checks for tokens.
The campaign worked on multiple attack routes at the same time. Researchers found proof that the agents found hidden API endpoints on a government website that gave valid authenticated sessions without needing passwords. The framework also ran automated password spraying on an office automation portal. It used employee usernames taken from exposed APIs and solved CAPTCHA images using OCR. By trying common password patterns, the agents broke into 85 accounts over several attempts.
Another flaw was with JWT processing. A government API was said to take tokens with the none algorithm. This let attackers create fake authentication tokens without needing a signing key. The hacked accounts were then checked against internal services.
84 out of 85 cracked accounts logged in to an internal system using an SSO bridge, which is a 98.8 percent success rate. This allowed the attackers to see internal dashboards, tools for managing equipment, and pages with personnel statistics.
The system tried to upload a web shell using a file-upload feature that had no limits. A second layer of Forms Authentication stopped it from running, proving that not every step of the automated attack worked.
Dream said the attackers took at least 2,564 personnel files. This included 1,409 employee records, 916 user records from an open API, and 239 legal records from a Ministry of Justice endpoint.
The archive had internal network ranges, 7 SSO client secrets, and 6 database passwords. The campaign is special because it uses feedback loops.
The agents made organized reports after each wave, ranked attack paths with Bayesian scoring, and did “Learning Cycles” to look for public vulnerability sources when earlier methods didn’t work. The system also found and ignored false positives, like a suspected SQL injection that was later linked to an SMTP timeout.
The event indicates that AI agents can now better work together for tasks like spying, stealing data, and attacking accounts. Defenders must focus on weak APIs, SSO trust issues, checking JWTs, protecting against credential-spraying, and reviewing public debug points.
