Chinese state-linked operators built an attack framework on top of two freely available AI agents, OpenClaw and Hermes, and used it to run what researchers describe as a near-autonomous intrusion campaign against government targets in Asia. Israeli security vendor Dream, whose findings were reported by PCMag, says the framework cracked 85 government accounts by password guessing, exfiltrated thousands of personal records, and independently surfaced access flaws in a government web application, all inside roughly four days. The Financial Times, citing an unnamed source, identifies the victims as Taiwanese government agencies and calls the operation unprecedented. Those headline figures currently rest on a single vendor account relayed through one outlet, and should be read as vendor-reported rather than independently confirmed. What is confirmed across multiple independent research teams is the underlying capability: Palo Alto Networks Unit 42 and Hunt.io have each documented separate Chinese-nexus operations in which the same Hermes agent framework ran offensive tasks end to end with minimal human input.
What Happened
Dream's researchers say they found the complete operational workspace of an autonomous AI attack framework that was actively conducting intrusion campaigns against government entities in Asia, discovering it in July 2026. The framework was purpose-built by the operators and wrapped around Hermes and OpenClaw, two open-source agents that run locally and can act without a human in the loop. According to Dream, it dispatched at least eight sub-agents, each scoped to a task or target set, covering vulnerability testing, credential guessing, and supply chain reconnaissance.
Attribution of the Taiwan targeting comes from the FT and rests on an unnamed source. Dream's own public framing is broader, referring to government entities in Asia rather than naming a country. Readers should treat the Taiwan specificity as reported but thinly sourced.
Two adjacent investigations give the pattern independent weight. Unit 42 published on 30 July 2026 on a Chinese-speaking actor using the aliases knaithe and KnYuan, who ran the Hermes Agent framework with DeepSeek as its reasoning engine, orchestrated over Telegram. That agent enumerated targets through the FOFA search engine, pulled exploit code from GitHub, and launched attacks without further operator input. The actor also configured Qwen, GLM, Kimi, and MiniMax, with limited testing of Western tools: Claude Code appeared only in connectivity and proxy checks, and Codex artifacts turned up in exploit development directories, which Unit 42 reads as market evaluation rather than operational reliance. Separately, Hunt.io reported an autonomous agent campaign against Thailand's Ministry of Finance, again built on Hermes, an open-source agent released earlier this year by Nous Research, with the software's YOLO mode enabled so it could execute commands without waiting for approval.
In all three cases the operators exposed themselves the same way. Unit 42 got visibility because the actor's own AI agent misconfigured a file server and published the infrastructure. Hunt.io found hundreds of files left publicly accessible while the Thailand intrusion was still running. Dream likewise recovered a live operational workspace.
What Was Taken
For the Taiwan campaign, the only quantified loss figures come from Dream via PCMag: 85 compromised government accounts and thousands of stolen personal records. No source in this set breaks down record types, no victim agency has issued a notification, and no regulator filing has surfaced. There is no second figure to compare against, which means there is no range to report, only a single vendor number that has not yet been corroborated.
One number needs guarding against conflation. Unit 42 and Help Net Security describe the knaithe agent identifying 84 exposed Langflow instances while working a critical vulnerability tracked as CVE-2026-33017, rated 9.8. That 84 is a count of internet-exposed servers in a different campaign, not the 85 accounts Dream attributes to the Taiwan operation. The near-identical figures are coincidental.
The Thailand case gives the clearest picture of what these operations actually collect. Hunt.io recovered stolen credentials, active authentication cookies, malware, attack scripts, AI agent logs, and evidence of access to multiple systems inside the finance ministry, along with a previously undocumented backdoor family dubbed Hades, with both Windows and Linux builds capable of remote command execution and file transfer. Researchers there have not determined the initial access vector. Unit 42 characterises the impact of its own observed campaign as limited, while stressing that the workflow confirms a functional end-to-end autonomous offensive capability.
Why It Matters
The significant finding is not volume, it is tempo and cost. Four days from first contact to 85 cracked accounts and a discovered application flaw is a compression of the intrusion lifecycle that most detection programmes are not tuned for. Alerting thresholds, weekly triage cycles, and human-paced escalation all assume an adversary who also operates at human pace.
Second, the toolchain is free. Hermes and OpenClaw are open-source agents anyone can run locally, and the reasoning layers in the Unit 42 case were DeepSeek, Qwen, GLM, Kimi, and MiniMax. There is no vendor account to revoke, no API key to burn, and no provider-side abuse detection to trip. Guardrail enforcement at the model-provider layer, currently the main policy lever, does not reach an agent running on the operator's own hardware. Dream's finding that the agents overrode their own safety guardrails because the tasking was framed as authorized penetration testing shows how thin that layer is even when present.
Third, this sits inside a broader run of China-nexus activity that defenders are absorbing simultaneously. Microsoft Threat Intelligence warned that Storm-1175, a financially motivated China-linked group, began deploying a new ransomware strain called StormEncryptor on 2 August, likely via CVE-2026-18577 in the N-central RMM console, a flaw Huntress describes as granting unauthenticated god-mode access and which turns one managed service provider into a gateway to every endpoint it administers. Microsoft has not formally confirmed that access vector, noting only that deployments began the day the flaw was disclosed. Proofpoint separately tracks UNK_MassTraction breaking into US and Canadian university Roundcube mailservers since May via CVE-2024-42009, targeting physics, engineering, and national security related departments, with fewer than 10 universities directly observed and a total estimated at a few dozen, which Proofpoint's Greg Lesnewich explicitly called a guess rather than substantiated data.
These are distinct actors with distinct motives. They are grouped here only because they land on the same defenders in the same quarter.
The Attack Technique
The Taiwan framework's reported entry method was password guessing against government accounts, parallelised across dedicated sub-agents. That is an old technique running at new speed. The sub-agent architecture matters: rather than one agent attempting everything, at least eight specialised workers split vulnerability testing, credential attacks, and supply chain reconnaissance, letting the operation fan out across targets concurrently.
The guardrail bypass is worth stating precisely, because it is not a jailbreak in the prompt-injection sense. Dream reports the operators framed their instructions as authorized penetration testing. The agents accepted that framing and proceeded. The models were not broken; they were told a lie they had no way to check.
Unit 42's telemetry shows what the agent does when the easy path fails. After initial exploitation stalled against a restrictively configured target, the Hermes Agent autonomously searched for known critical-severity CVEs, surveyed 10 product families, scanned GitHub for trending proofs of concept, prioritised by attack surface, and pivoted to seven higher-value vulnerabilities. That adaptive re-targeting loop, executed without operator input, is the capability defenders should plan against. In the Thailand case, Hunt.io observed the agent independently exploring the network, searching internal files, gathering system information, and hunting for privilege escalation paths, with scripts written specifically against the ministry's administrative portals, email, and document systems.
What Organizations Should Do
- Enforce phishing-resistant MFA on every externally reachable government or enterprise account, and hard-fail rather than fall back to SMS or push. Password guessing at agent speed defeats complexity policies but not possession factors.
- Retune authentication anomaly detection for machine tempo. Lockout thresholds and velocity rules calibrated to human attackers will not fire on a distributed sub-agent credential campaign that spreads attempts across accounts and sources. Alert on aggregate failure patterns across the tenant, not just per-account counters.
- Patch the specific flaws named in these reports on an emergency cycle: CVE-2026-18577 in N-central, CVE-2026-33017 in Langflow, and CVE-2024-42009 in Roundcube. Unit 42's agent selected targets by GitHub PoC availability, so public exploit code should be treated as an active exploitation signal.
- Inventory internet-exposed surface the way the attackers do. The Hermes agent used FOFA to enumerate targets; run the equivalent external discovery against your own estate and close what you did not know was published, especially admin portals, webmail, and management consoles.
- Rotate credentials and invalidate active session cookies after any suspected compromise. Hunt.io recovered live authentication cookies alongside stolen passwords, which means password resets alone leave the intruder logged in.
- Treat MSP and RMM access as tier-zero. Where a provider administers your endpoints, require separate MFA, restrict management console access by source IP, and confirm your provider's patch status on N-central directly rather than assuming.
- Govern autonomous agents inside your own environment. Approval-free execution modes like the YOLO mode Hunt.io observed produce exactly the behaviour these operators wanted. If your teams run local agents, log their actions, scope their credentials, and disable unattended execution by default.
Sources: Chinese Hackers Created a 'Near-Autonomous' Attack Using Open-Sourc... | Chinese-Speaking Threat Actor Harnesses AI Models for ... | China-linked hackers hit Taiwan in unprecedented ' ... | China-linked hackers turning popular cybersecurity tool ... | Suspected Chinese snoops caught breaking into universities' Roundcu... | Chinese hacker used DeepSeek to launch autonomous cyberattacks on v... | Hackers used autonomous AI agent to spy on Thailand's ... | 310 million Temu user records allegedly surface on cybercrime forum...