Open-Source AI Agents Breached Taiwan’s Government — Developers, Take Note

Chinese-linked threat actors used open-source AI agent frameworks Hermes and OpenClaw to breach 21 Taiwanese government systems, including the nuclear safety regulator, in 12 waves of autonomous attacks from July 1–4, 2026, compromising 85 accounts and stealing over 2,500 personnel records, according to Israeli-Austrian cybersecurity firm Dream, which found the operation in a 1,395-file archive left exposed on the public internet. The agents exploited known vulnerabilities like JWT tokens with algorithm 'none' and bypassed CAPTCHAs using Tesseract OCR, adapting via Bayesian 'Learning Cycles' when blocked. Dream warns developers to treat agent deployments as web applications with database write access and not expose them without authentication.

Eight AI agents. Four days. Two open-source frameworks that together hold 480,000 GitHub stars. In early July, Chinese-linked threat actors used Hermes https://hermes-agent.org/ and OpenClaw — tools built by and for developers — to run 12 waves of autonomous attacks against Taiwanese government networks. Taiwan’s nuclear safety regulator was hit. Eighty-five accounts were compromised. Over 2,500 personnel records were stolen. Dream, an Israeli-Austrian cybersecurity firm, found the entire operation sitting in a 1,395-file archive the attackers had left exposed on the public internet. The operators needed no proprietary exploits. No custom tooling. They adjusted some prompts and pointed widely-available AI agent frameworks at a government. It got worse from there. How Eight Agents Cracked 21 Government Systems The attack ran in 12 waves across four days July 1–4, 2026 , deploying up to eight parallel sub-agents per wave, each assigned a specialized role: reconnaissance, credential acquisition, exploitation, record collection, backdoor installation, and adaptive re-attack. Dream’s researchers reconstructed the full sequence from the leaked 1,395-file workspace https://www.theregister.com/security/2026/08/12/near-autonomous-ai-agents-attack-taiwans-nuclear-safety-agency/5289286 . The exploits were not sophisticated by nation-state standards — which is itself the alarming part. The agents hit JWT tokens configured with the algorithm field set to none , a documented misconfiguration that skips signature verification entirely. They bypassed CAPTCHAs using Tesseract OCR. They found exposed debug endpoints handing out valid sessions without credentials. Classic vulnerabilities. Automated at scale. What changed the equation was what happened when the agents were blocked. The framework triggered what Dream called “Learning Cycles”: a Bayesian modeling process that searched public vulnerability databases, evaluated alternative attack paths, and retried with new techniques. The agents generated new identities in real-time, switched platforms, and discovered unauthenticated API endpoints the operators hadn’t specified. They adapted. Traditional rule-based defenses did not. The Tools Were Built for Developers Hermes is an open-source AI agent framework released by Nous Research in February 2026. MIT license. One command to install. Its GEPA self-improvement mechanism — accepted at ICLR 2026 — makes agents 40 percent faster on repeated tasks by generating and refining their own skills. It ships with persistent cross-session memory and integrates with Telegram, Slack, Discord, and WhatsApp. OpenClaw launched in November 2025 and reached 380,000+ GitHub stars faster than any AI agent project on record. It accepts natural language commands and executes them with high-authority access: email, calendar, browser control, file operations, and shell command execution. Its community plugin repository, ClawHub, has been used to distribute malicious packages. Many OpenClaw instances run on the public internet over unencrypted HTTP. The project has published over 255 GitHub Security Advisories. The Taiwan operators bypassed both frameworks’ safety measures by framing the campaign as “authorized penetration testing” and providing supporting documentation in Simplified Chinese. This is not a novel jailbreak. It is a documented, known limitation https://nsfocusglobal.com/openclaw-open-source-ai-agent-application-attack-surface-and-security-risk-system-analysis/ of current agent safety frameworks — they protect against accidental misuse, not determined adversaries with a cover story. What Developers Must Do Now If you have Hermes, OpenClaw, or any similar agent framework deployed, treat it as you would a web application with database write access — because that is what it is. Do not expose agent instances to the public internet without authentication. Unauthenticated endpoints are the first thing automated scanners hit. Use HTTPS. A significant number of OpenClaw instances are running unencrypted. Credential theft over HTTP takes seconds. Apply least privilege. If your agent does not need shell execution, disable it. If it does not need file write access, remove it. Audit your plugins. ClawHub packages should be treated with the same scrutiny as npm install — review source, check Security Advisories, pin versions. Put humans in the loop for irreversible actions. The Taiwan attack succeeded partly because agents could act without any approval gate. Any agent with write access to sensitive systems needs a confirmation checkpoint. CrowdStrike’s analysis https://www.crowdstrike.com/en-us/blog/what-security-teams-need-to-know-about-openclaw-ai-super-agent/ is direct: developers must treat agent deployments “like hardened infrastructure” and deploy runtime guardrails before exploitation becomes widespread. Most have not yet. The Question the Community Needs to Answer Both Hermes and OpenClaw are legitimate tools. The developers who built them are not responsible for this attack. But the security culture around AI agent frameworks has not caught up to what these tools can now do. We apply rigorous security reviews to web APIs and database access. We run penetration tests on microservices. We treat npm packages with suspicion. AI agent deployments — which often have more system access than any of those — get starred, cloned, and deployed with a default config and an open port. Dream’s Chief Strategy Officer Amir Becker put it plainly: “Governments must henceforth assume a permanent state of attack.” That applies to every organization running an agent with internet access and elevated privileges. The Taiwan attack used open-source tools, well-known vulnerabilities, and a three-word jailbreak. The bar is lower than the developer community wants to admit. The window to raise it is now.