InfoSecBulletin Cybersecurity for mankind
A cyberattack using open-source AI tools almost ran on its own. It affected government systems in Asia, compromised into 85 employee accounts, and took over 2,500 personal records, as per a study from Dream.
The campaign shows how AI agents can work together to carry out big chunks of a hacking job really fast. Researchers found a 160 MB file with 1,395 files related to the job. This material recorded 12 attack waves that happened from July 1 to July 4, 2026.
CISA Warns of Cisco Secure Email Gateway 0-Day Flaw Actively Exploited in Attacks
VPN flaw exposed 246,000 personnel records in japan
Hackers deploy Casbaneiro Trojan that activates on bank websites
German police read Signal, Telegram, WhatsApp messages without breaking encryption
Urgent Patch! cPanel, GitLab Flaws Expose Users to RCE, File and Credential Theft
Palo Alto PAN-OS Flaw Enables Root Arbitrary Code Execution
Critical Check Point VPN flaws allow remote code execution attacks
Cisco confirms CVE-2026-20079 flaw in Secure FMC is exploited in attacks
Hackers exploit PaperCut flaws using hundreds of AI agents, compromising 440 servers globally
CISA Says Chinese Firms Extracted Billions of Tokens From Frontier AI Models
The system used Hermes and OpenClaw, sending out up to 8 sub-agents at the same time to do tasks like scouting, password attacks, API testing, gathering data, and moving sideways. The researchers did not find out which entities were affected or who was behind it.
Dream mentioned that the paperwork used Simple Chinese for internal reports and Traditional Chinese for target analysis. This hints at a Chinese-speaking operator. Public reports pointed to Taiwan as the target, but Dream’s report only talked about the victims as government groups in Asia.
AI Agents Breach Government Systems
The AI system started by downloading and examining JavaScript files from a government website. It took out API links, OAuth client IDs, Keycloak setup information, and login details.
This allowed the agents to find 21 linked government systems, including a single sign-on setup. One target supposedly showed over 36 API points for managing accounts, user data, uploads, and control.
Some points in the system did not need a password, letting it get employee details like names, departments, and SSO account IDs. The agents also collected public SSO integration guides and SDK examples.
The framework found some possible client-side flaws, but the confirmed issues mainly came from server-side flaws. These included APIs that didn’t need authentication, insecure login points, and weak checks for tokens.
The campaign worked on multiple attack routes at the same time. Researchers found proof that the agents found hidden API endpoints on a government website that gave valid authenticated sessions without needing passwords. The framework also ran automated password spraying on an office automation portal. It used employee usernames taken from exposed APIs and solved CAPTCHA images using OCR. By trying common password patterns, the agents broke into 85 accounts over several attempts.
Another flaw was with JWT processing. A government API was said to take tokens with the none algorithm. This let attackers create fake authentication tokens without needing a signing key. The hacked accounts were then checked against internal services.
84 out of 85 cracked accounts logged in to an internal system using an SSO bridge, which is a 98.8 percent success rate. This allowed the attackers to see internal dashboards, tools for managing equipment, and pages with personnel statistics.
The system tried to upload a web shell using a file-upload feature that had no limits. A second layer of Forms Authentication stopped it from running, proving that not every step of the automated attack worked.
Dream said the attackers took at least 2,564 personnel files. This included 1,409 employee records, 916 user records from an open API, and 239 legal records from a Ministry of Justice endpoint.
The archive had internal network ranges, 7 SSO client secrets, and 6 database passwords. The campaign is special because it uses feedback loops.
The agents made organized reports after each wave, ranked attack paths with Bayesian scoring, and did “Learning Cycles” to look for public vulnerability sources when earlier methods didn’t work. The system also found and ignored false positives, like a suspected SQL injection that was later linked to an SMTP timeout.
The event indicates that AI agents can now better work together for tasks like spying, stealing data, and attacking accounts. Defenders must focus on weak APIs, SSO trust issues, checking JWTs, protecting against credential-spraying, and reviewing public debug points.
