Security researchers at Dream Security have documented what may be the first fully autonomous multi-agent AI cyberattack to compromise government systems, with eight AI sub-agents working in parallel to breach networks in Asia and steal more than 2,500 personnel records.
The campaign, which ran from July 1 to July 4, 2026, used two publicly available open-source agent frameworks to conduct 12 distinct attack waves without requiring a human operator to steer each step. Dream said the operational workspace recovered from the attacker contained more than 160 megabytes across 1,395 files, giving researchers a complete picture of how the AI agents coordinated reconnaissance, exploitation, credential attacks, and data theft.
How the Agents Operated
The framework began by downloading and decompiling JavaScript bundles from a government portal, extracting API endpoints, OAuth client IDs, and Keycloak configuration data. From that single entry point, the agents mapped 21 connected government systems including the national single sign-on infrastructure. One target alone exposed more than 36 API endpoints, many completely unauthenticated.
The eight agents, designated A through Q in internal logs, were assigned separate targets and techniques, with as many as eight running concurrently in a single wave. When initial techniques failed, the framework ran Learning Cycles that searched public vulnerability databases for new approaches, scored attack paths using Bayesian probability, and discarded false positives through repeated verification.
Entry points were alarmingly basic. An unauthenticated API returned the departments entire employee list. Passwords built from employee IDs were cracked by spraying decorated variations. Three hidden debug endpoints in production accepted any request and returned valid authenticated sessions. An API accepted JWT tokens with the algorithm field set to none, allowing token forgery without a signing key.
Scale of the Breach
By the end of the four-day operation, the agents had extracted at least 2,564 personnel records, including 1,409 employee entries, 916 user records from an exposed API, and 239 legal-professional records from a Ministry of Justice endpoint. The stolen archive also contained internal network ranges, seven SSO client secrets, and six database credentials.
Of the 85 cracked government employee accounts, 84 – or 98.8 percent – successfully pivoted into connected internal systems. The framework also attempted to upload a web shell through an unrestricted file-upload endpoint, though a secondary authentication layer blocked execution.
Linguistic analysis of the frameworks internal reporting switched between Simplified and Traditional Chinese, pointing to a Chinese-language operator. Public reporting identified Taiwan as the target, though Dreams report described the victims only as government entities in Asia.
The study marks a turning point for cybersecurity defense. Dream Securitys full report notes that the actual entry points were ordinary security missteps found in routine audits. What the AI layer changed was throughput and cost – the price of mounting a competent attack has collapsed while the cost of defending has not.
discussion