A multi-agent attack using open-source AI frameworks executed a coordinated intrusion over four days.
Autonomous AI agents built on open-source frameworks breached Taiwanese government systems, compromised credentials, and probed a nuclear safety agency in a multi-day cyberattack that researchers say signals a new phase in AI-enabled operations.
The campaign unfolded over four days in early July, during which multiple AI agents operated in parallel to map networks, identify vulnerabilities, and execute intrusion steps across interconnected systems, according to research published by cybersecurity firm Dream.
“In roughly four days, the agentic attacker produced 1,395 files, 85 cracked credentials, thousands of exfiltrated personnel records, and gained a persistent foothold inside state infrastructure,” Dream wrote in a blog post. “It spells out one thing loudly – the cost of running a competent attack has collapsed, but the cost of defending against one has not.”
They described the activity as a “near-autonomous attack,” adding that “AI-enabled offensive operations are now at an inflection point.”
Taiwan link emerges as government flags AI-assisted attack
Dream did not identify the affected country but stated that it was “government entities in Asia.” However, Taiwan’s Ministry of Digital Affairs said it detected an “AI agent-assisted” cyberattack targeting government agencies during the same period, according to Reuters, which reported that the activity involved AI-driven tools such as OpenClaw.
“The relevant attack sources, methods, and scope of impact have all been fully investigated, and the affected units have successively completed their handling,” the report added, quoting an official from the Ministry of Digital Affairs of Taiwan, though neither Dream nor Taiwanese authorities have explicitly confirmed a link between the two.
Responding to CSO’s queries, a Dream spokesperson declined to comment on the identity of the target or the attacker and said its research did not find evidence of a confirmed breach of the entity’s systems. “We cannot comment on the identity of the target or attacker. Our report describes the framework at the time of our analysis.”
The company further said that since the publication of its initial blog post, it has identified evidence indicating the use of a DeepSeek-V4-Flash model within this framework. “We do not know whether it was the only model used,” the spokesperson said.
The Government of Taiwan did not immediately respond to a request for comment.
Multi-agent system executes coordinated attack waves
The researchers wrote that the attack framework was built on Hermes and OpenClaw agents and deployed multiple sub-agents simultaneously, each assigned to specific targets and tasks across successive attack waves.
Across 12 attack waves, the agents carried out reconnaissance, credential attacks, and exploitation efforts in parallel, incorporating planning loops and feedback mechanisms.
This allowed the system to “run an intrusion campaign rather than answer questions about one,” the researchers wrote.
Colin Ferris, head of threat hunting and incident response at Silverfort, said the use of multiple agents working in parallel reflects how such systems can divide tasks and adapt in real time.
“AI does to cybersecurity what cheap drones have done to conventional warfare,” Ferris said, adding that attackers can deploy “a handful of inexpensive AI agents to continuously find and exploit the gaps they haven’t fixed yet.”
Identity systems and APIs form initial entry points
The campaign began with automated reconnaissance, during which the system mapped government infrastructure by extracting API endpoints and authentication configurations from publicly accessible code, according to the blog post.
The researchers wrote that the framework identified unauthenticated APIs exposing user data and, in one instance, an entire user database without authentication.
They added that the system used a combination of techniques to gain access, including exploiting hidden authentication endpoints, conducting credential attacks, and bypassing token validation mechanisms.
The compromised accounts were then used to move laterally across connected systems through single sign-on integrations.
Cris Thomas, security advocate at cybersecurity firm Semgrep, said the techniques described are not new, but AI is changing how they are executed.
“This demonstrates that AI is just a tool, one that defenders and attackers can both use,” Thomas said. “Attackers are going to attack, and they will find a way around a harness and other restrictions.”
Campaign expands to supply chain and critical sectors
The researchers wrote that the operation extended beyond initial targets to include supply chain partners, a government email system, and organizations in the energy sector.
They added that the campaign reached a nuclear safety-related organization, though the report does not identify the country or specify the level of access achieved.
Ferris said such campaigns highlight how attackers can use widely available tools to scale operations, noting that systems can “research targets, divide responsibilities, and change tactics when blocked.”
Growing concern over autonomous AI in cyber operations
Recent disclosures from AI developers have pointed to similar risks. OpenAI recently said it cannot rule out that advanced models could autonomously identify and exploit vulnerabilities, while Anthropic has reported instances of AI agents attempting to access external systems during testing.
The researchers wrote that safeguards designed to restrict AI behavior were bypassed in the campaign by framing the activity as authorized testing. They added that linguistic analysis suggests the campaign was carried out by a “Chinese-language operator,” though the report does not attribute it to any specific group or country.