Multi-Agent Framework Compromises Taiwanese Government Systems

Incident overview

In early July 2026, an unknown Chinese-language operator used a multi-agent framework built on Hermes and OpenClaw against government systems that subsequent public reporting identified as Taiwanese. Dream Research Labs recovered a 160 MB operational workspace containing 1,395 files documenting 12 attack waves conducted from July 1 through July 4. Taiwan's Ministry of Digital Affairs separately confirmed detecting abnormal attacks during July involving a hybrid of human operation and OpenClaw-assisted activity.

The agentic AI framework coordinated up to eight specialized sub-agents concurrently across reconnaissance, authentication attacks, API testing, vulnerability research, and exploitation. A probabilistic decision engine ranked findings and 14 candidate attack paths, allocated additional testing to promising results, discarded invalidated paths, and used after-action reports to redirect subsequent activity.

Starting from an internet-facing government portal, the framework decompiled client-side application bundles and mapped connected systems, identity infrastructure, and exposed APIs. It obtained access through exposed debug endpoints, unsigned JWT acceptance, and password spraying based on personnel identifiers collected from unauthenticated APIs. Tesseract OCR automated CAPTCHA solving, reportedly helping compromise 85 accounts, 84 of which authenticated to another government system through an SSO bridge without additional MFA or user confirmation.

Dream Research Labs reported the extraction of more than 2,564 personnel records, a complete user-database export, SSO configuration and client information, database credentials, and internal network ranges.

AIDEFEND analysis: Government defenders can apply five existing controls at boundaries they operate: AID-I-003.001 for reversible containment of a verified malicious source at the application/API edge, AID-DV-006 for isolated non-fallback decoy routing on retired debug paths, AID-E-001.001 for resetting compromised human passwords, AID-E-001.002 for revoking sessions abused through SSO or issued through debug endpoints, and AID-R-003.001 for trusted interactive-session recovery after eviction. These are deployment recommendations, not evidence that the victims implemented them or that AIDEFEND would automatically stop the campaign.

They require trusted findings, working enforcement/identity adapters, and independent verification.

Prioritize closing the unauthenticated personnel API, removing session-issuing debug endpoints, rejecting unsigned or incorrectly signed JWTs, and strengthening password and MFA policy. Test each independent access route: blocking a source or revoking SSO sessions does not repair the public API or the token-forgery path. For SSO response, inventory every issuer and downstream session class, invalidate the affected population, and prove old sessions fail at each relying service before permitting recovery. Keycloak configuration appears in the source, but the report does not establish that every abused SSO session was Keycloak-issued.

The supplied revocation script applies only to verified Keycloak online user sessions; other session classes need their own authoritative adapters.

Password reset must use the affected identity provider: AID-E-001.001-G002 explicitly permits an equivalent provider-native reset API, but its Cognito script is not portable unchanged. Verify old-password denial separately from old-session denial. For JWT repair, AID-H-004.002-G001 contains a verifier that rejects alg:none and validates signatures and claims. Its full guidance governs machine/service authentication to AI systems, which is not established for this victim API; it is an adaptation reference, not a formal mapping here. Revoking tokens is not a substitute for correcting the verifier.

Separately, AID-D-001.001, AID-H-002.002, and AID-D-003.005 remain conditional anti-abuse candidates for an independently operated model service with sufficient visibility and enforcement. The actual model, hosting arrangement, and provider-visible session scope are not identified. Those candidates are not counted as government-deployable defenses.