Eight agents, four days, 1,395 files: the AI intrusion campaign that mostly ran itself

Israeli AI company Dream says its threat research team recovered the complete operational workspace of an autonomous attack framework that had been running intrusion campaigns against government entities in Asia, a 160-megabyte archive of 1,395 files found in early July 2026 ^[1][2]. Taiwan's Ministry of Digital Affairs confirmed on August 13 that foreign hackers used AI tools against government systems in July, saying its cybersecurity units detected the intrusion and responded under established procedures ^[3][4].

The operating tempo is the story. Dream documents 12 attack waves across roughly four days, July 1 to 4, with up to eight lettered sub-agents dispatched in parallel per wave and agents A through Q observed over the campaign ^[5][6]. That is about three waves per day ^[7] and roughly 349 files of output per day ^[8]. Dream reports 85 cracked government employee credentials, thousands of exfiltrated personnel records, a signature validation flaw discovered in the government's personal authentication service, and persistent backdoors installed on government web applications ^[9][10].

Reconnaissance started from one page. According to Dream, the framework downloaded and decompiled JavaScript bundles from an Angular-based government portal, pulled out embedded URLs, API endpoints, OAuth client IDs and Keycloak configuration, then identified 21 connected government systems and mapped the national SSO architecture including six sub-realms, all OIDC endpoints and two RSA signing keys ^[11][12].

The scaffolding matters more than the model. Dream describes posterior probability scoring used to continuously reprioritise 14 parallel attack chains, "Learning Cycles" that search vulnerability databases, GitHub and security publications when a technique is blocked, and structured after-action reports that feed each wave's results into the next without human intervention ^[13][14][15]. The framework was built on the Hermes and OpenClaw agents ^[16], which Taiwan News describes as open-source agent systems; humans picked the target and set the mission, and the AI handled much of the reconnaissance, testing and coordination ^[17]. Model refusals, the only real constraint in the stack, were bypassed by framing everything as authorised penetration testing ^[18].

Attribution is thin and stated as such. Dream's linguistic analysis notes code-switching between Simplified Chinese in internal status reports and Traditional Chinese in target-facing analysis, which it reads as a Chinese-language operator ^[19]. The Financial Times, which broke the story, called it possibly the first known end-to-end autonomous cyberattack against a government target and referred to "suspected Chinese hackers" ^[20]. The ministry attributed the activity to "overseas sources" and did not name China ^[21]. Dream withheld the identity of both the targets and the operator, and notified affected organisations before publishing ^[22].

The record count does not reconcile cleanly: Dream's own summary says thousands of personnel records, while Taiwan News reports Dream's figure as more than 2,500, along with follow-on targeting of the country's nuclear safety agency and at least seven energy companies ^[10][23]. Treat the exact number as unsettled.

Dream's conclusion is the one defenders should argue with or budget for: the cost of running a competent attack has collapsed and the cost of defending against one has not ^[24]. The ministry made a related point, telling the FT that AI agents bring dual challenges because attacks are automated and the agents themselves become new vulnerabilities ^[25]. For scale, Taiwan's National Security Bureau said in January that critical infrastructure faced an average of 2.63 million Chinese cyberattack attempts a day in 2025, 6 percent above the prior year ^[26].

Watch whether other national CERTs find the same harnesses in their own logs, and whether any vendor publishes detection guidance keyed to agentic behaviour rather than payloads.