Eight AI agents. Four days. Two open-source frameworks that together hold 480,000 GitHub stars. In early July, Chinese-linked threat actors used Hermes and OpenClaw — tools built by and for developers — to run 12 waves of autonomous attacks against Taiwanese government networks. Taiwan’s nuclear safety regulator was hit. Eighty-five accounts were compromised. Over 2,500 personnel records were stolen. Dream, an Israeli-Austrian cybersecurity firm, found the entire operation sitting in a 1,395-file archive the attackers had left exposed on the public internet.
The operators needed no proprietary exploits. No custom tooling. They adjusted some prompts and pointed widely-available AI agent frameworks at a government. It got worse from there.
How Eight Agents Cracked 21 Government Systems #
The attack ran in 12 waves across four days (July 1–4, 2026), deploying up to eight parallel sub-agents per wave, each assigned a specialized role: reconnaissance, credential acquisition, exploitation, record collection, backdoor installation, and adaptive re-attack. Dream’s researchers reconstructed the full sequence from the leaked 1,395-file workspace.
The exploits were not sophisticated by nation-state standards — which is itself the alarming part. The agents hit JWT tokens configured with the algorithm field set to none
, a documented misconfiguration that skips signature verification entirely. They bypassed CAPTCHAs using Tesseract OCR. They found exposed debug endpoints handing out valid sessions without credentials. Classic vulnerabilities. Automated at scale.
What changed the equation was what happened when the agents were blocked. The framework triggered what Dream called “Learning Cycles”: a Bayesian modeling process that searched public vulnerability databases, evaluated alternative attack paths, and retried with new techniques. The agents generated new identities in real-time, switched platforms, and discovered unauthenticated API endpoints the operators hadn’t specified. They adapted. Traditional rule-based defenses did not.
The Tools Were Built for Developers #
Hermes is an open-source AI agent framework released by Nous Research in February 2026. MIT license. One command to install. Its GEPA self-improvement mechanism — accepted at ICLR 2026 — makes agents 40 percent faster on repeated tasks by generating and refining their own skills. It ships with persistent cross-session memory and integrates with Telegram, Slack, Discord, and WhatsApp.
OpenClaw launched in November 2025 and reached 380,000+ GitHub stars faster than any AI agent project on record. It accepts natural language commands and executes them with high-authority access: email, calendar, browser control, file operations, and shell command execution. Its community plugin repository, ClawHub, has been used to distribute malicious packages. Many OpenClaw instances run on the public internet over unencrypted HTTP. The project has published over 255 GitHub Security Advisories.
The Taiwan operators bypassed both frameworks’ safety measures by framing the campaign as “authorized penetration testing” and providing supporting documentation in Simplified Chinese. This is not a novel jailbreak. It is a documented, known limitation of current agent safety frameworks — they protect against accidental misuse, not determined adversaries with a cover story.
What Developers Must Do Now #
If you have Hermes, OpenClaw, or any similar agent framework deployed, treat it as you would a web application with database write access — because that is what it is.
Do not expose agent instances to the public internet without authentication. Unauthenticated endpoints are the first thing automated scanners hit.Use HTTPS. A significant number of OpenClaw instances are running unencrypted. Credential theft over HTTP takes seconds.Apply least privilege. If your agent does not need shell execution, disable it. If it does not need file write access, remove it.Audit your plugins. ClawHub packages should be treated with the same scrutiny asnpm install
— review source, check Security Advisories, pin versions.Put humans in the loop for irreversible actions. The Taiwan attack succeeded partly because agents could act without any approval gate. Any agent with write access to sensitive systems needs a confirmation checkpoint.
CrowdStrike’s analysis is direct: developers must treat agent deployments “like hardened infrastructure” and deploy runtime guardrails before exploitation becomes widespread. Most have not yet.
The Question the Community Needs to Answer #
Both Hermes and OpenClaw are legitimate tools. The developers who built them are not responsible for this attack. But the security culture around AI agent frameworks has not caught up to what these tools can now do. We apply rigorous security reviews to web APIs and database access. We run penetration tests on microservices. We treat npm packages with suspicion. AI agent deployments — which often have more system access than any of those — get starred, cloned, and deployed with a default config and an open port.
Dream’s Chief Strategy Officer Amir Becker put it plainly: “Governments must henceforth assume a permanent state of attack.” That applies to every organization running an agent with internet access and elevated privileges. The Taiwan attack used open-source tools, well-known vulnerabilities, and a three-word jailbreak. The bar is lower than the developer community wants to admit. The window to raise it is now.