What is a near-autonomous AI cyberattack in 2026? Hermes, OpenClaw, and a government breach
Dream published a near-autonomous multi-agent intrusion workspace on 12 August; press followed the next day. This piece separates what the report documents from what it does not.
On 12 August 2026, Dream Research Labs, the research arm of Israeli security company Dream, published a report: in early July it obtained an attack workspace of about 160MB and 1,395 files. The report calls this a near-autonomous intrusion against government entities in Asia — not a demo chat log.
On 13 August, CyberScoop, PCMag and others followed, calling it the first publicly documented near-autonomous AI attack on a government target and naming Taiwan. Dream’s own text says “government entities in Asia”; the Taiwan identification comes from later coverage and the Financial Times. State or APT attribution is not a finding in the report. What follows is only what public material can check: the framework’s name, what happened in four days, and what remains inference.
What a near-autonomous AI cyberattack is
Dream places the campaign at the crossing of three curves: open weights make near-frontier reasoning cheaper; agent harnesses can plan, dispatch in parallel, keep memory, and write after-action reports; guardrails stop only operators who ask honestly. The word they use is near-autonomous: after a human sets the orchestration, the model retargets and changes technique mid-campaign.
How the Hermes and OpenClaw framework ran
The workspace used two identifiers: .hermes and .openclaw. Sub-agents were lettered; the campaign shows Agent A through Agent Q, with up to eight in parallel per wave, sent in three batches. Dream writes that about four days produced 1,395 files — a volume inconsistent with one person working by hand.
-
1
Recon: unpack the government graph from a portal
The framework downloaded and decompiled Angular JavaScript from a government portal, extracting URLs, APIs, OAuth client IDs, and Keycloak config. The report says that yielded 21 connected systems and a national SSO map: six sub-realms, all OIDC endpoints, two RSA signing keys. One system exposed its full user store with no authentication.
-
2
Access: backdoors, spraying, JWT
Several entry points ran in parallel: leftover debug APIs in production that returned a session for any request body; password spraying against an office-automation portal using names from the unauthenticated user API, with Tesseract OCR on CAPTCHAs at a reported 100% accuracy, yielding 85 accounts across rounds; and an API that accepted JWTs with
alg=none, so identity tokens could be forged without a signing key. -
3
Lateral movement and theft
84 of 85 accounts (98.8%) crossed an SSO bridge into an internal information system. Personnel records are listed as 2,564+: 1,409 employees, 916 from an unauthenticated API, 239 from an unauthenticated justice-related endpoint. The framework also scanned IT vendors, a nuclear-safety agency, a government mail system, and seven-plus energy firms — scans, not confirmed compromise of all of them.
Why this is not “just run a model”
Bayesian ranking, not spray-and-pray
Findings start at prior P=0.50, then update on scans, curl confirmation, impact, and WAF constraints; only P>0.95 is promoted into an attack chain. The archive states P_success = P_chain × (1 − P_blocker). SSO lateral movement was scored 99%; 98.8% of accounts later pivoted.
It researched new techniques mid-campaign
So-called Learning Cycles search vulnerability databases, GitHub, and papers, trimmed to the target government’s stack. The archive has five rounds, v1 through v5, including known CVEs in country-specific products and common portal weaknesses.
It discarded its own false positives
The 12-wave summary lists seven false positives. The clearest: a registration nickname field flagged as blind SQLi after a 21-second delay; retest showed an SMTP timeout, not SLEEP(5). Confirmed items still needed two more rounds of three-agent cross-checks.
| Public claim | Dream report | Later coverage |
|---|---|---|
| Target | Government entities in Asia | Taiwan (FT / CyberScoop / PCMag) |
| Operator | Simplified/Traditional code-switching; Chinese-language operator | Some headlines say “Chinese hackers”; that is not official attribution |
| Guardrails | All activity framed as authorized pentesting | Matches the report |
Dream’s point, in substance: reaching this level takes more than opening a model. It takes task tuning, agent coordination, and decision logic — the Bayesian ranking, self-correction, and learning loops in this framework.
# Public timeline (from reporting)
2026-07-01–04 12 attack waves (Dream)
2026-07 early Workspace discovered
2026-08-12 Dream publishes; details first shared with FT
2026-08-13 CyberScoop / PCMag followHow to read the boundaries
- Cost asymmetry is the report’s core judgment
- Dream writes that a competent attack got cheaper while defense did not fall in proportion. That is the authors’ conclusion, not a new event fact.
- The webshell did not become full RCE
- An unrestricted upload dropped a webshell; Forms Authentication blocked execution. The report logs a partial success.
- SDK static analysis did not match the real break-ins
- The framework pulled Java and ASP.NET SSO samples from GitBook and ran local SAST; overlap with the confirmed vulnerability list was zero. The wins were server-side issues a black box could find.
Questions worth checking
Is this a confirmed nation-state attack?
No. Dream infers a Chinese-language operator from Simplified Chinese in internal status notes and Traditional Chinese in target-facing analysis. Headlines that say “Chinese hackers” are press, not a confirmed Dream attribution.
Is the target confirmed as Taiwan?
Dream’s body says government entities in Asia. CyberScoop and PCMag name Taiwan and cite the Financial Times. Keep both phrasings; do not treat the press naming as Dream’s stamp.
Are Hermes and OpenClaw purpose-built malware?
Dream describes them as popular open-source AI agent frameworks. Attackers layered multi-agent orchestration on top. The report does not equate those names with a single commercial malware brand.