China-Linked Actor Uses Autonomous AI Agent Frameworks (Hermes, OpenClaw) to Breach Taiwan Government and Critical Infrastructure

China-Linked Actor Uses Autonomous AI Agent Frameworks (TL-2026-1997) is a critical-severity advanced persistent threat campaign, first published 2026-08-12. It is linked to a China-nexus actor with medium confidence, affects Government of Taiwan Government web portals and Keycloak-based SSO, maps to 12 MITRE ATT&CK / ATLAS techniques (AML.T0054, T1020, T1078), and is covered by 9 detection rules and 7 indicators of compromise.

Key facts for TL-2026-1997

Threat ID
TL-2026-1997
Severity
CRITICAL
Status
ACTIVE
Category
APT
First published
2026-08-12
Last reviewed
2026-08-12
Attribution confidence
MEDIUM
Nation-state nexus
China
Motivation
ESPIONAGE
Target sectors
government administration, energy, nuclear regulatory, critical infrastructure
Target regions
taiwan, Asia-Pacific
Detection rules
9
Indicators of compromise
7

Malware and tooling in China-Linked Actor Uses Autonomous AI Agent Frameworks

Malware and tooling: Hermes, Hermes Agent, OpenClaw, Tesseract OCR

Israeli cybersecurity firm Dream disclosed what it describes as the first fully autonomous, end-to-end cyberattack on a foreign government: a suspected China-linked operation that chained the open-source AI agent frameworks Hermes Agent and OpenClaw into a self-directed offensive tool, running up to eight concurrent agents across 12 attack waves over four days in early July 2026 to compromise Taiwanese government portals, the Nuclear Safety Commission, and at least seven energy companies.

How China-Linked Actor Uses Autonomous AI Agent Frameworks works

Over four days from July 1-4, 2026, an operator Dream Security's Threat Research team assesses is likely China-connected ran a multi-agent AI attack framework built on two open-source agentic AI projects, Hermes Agent (from Nous Research) and OpenClaw, against Taiwanese government infrastructure. Sub-agents operated under distinct .hermes and .openclaw workspace identifiers, with up to eight lettered sub-agents (A through Q) running concurrently per wave across 12 documented waves.

The operation began with reconnaissance: agents decompiled client-side Angular JavaScript bundles served by government portals to enumerate URLs, API endpoints, OAuth client IDs, and Keycloak SSO configuration, mapping 21 connected government systems and more than 36 unauthenticated API endpoints. A parallel SDK-harvesting stage autonomously scraped GitBook documentation portals via llms.txt indexing and raw .md content access to pull SSO integration SDK material.

For initial access, the agents found three hidden backdoor API endpoints that accepted arbitrary request bodies without authentication, used Tesseract OCR to defeat CAPTCHA protection on an office-automation portal, and forged JSON Web Tokens by setting the algorithm field to "none" to bypass signature validation. Other identified weaknesses supporting the intrusion included an open redirect (CSRF protection disabled, unvalidated redirectUri), an unrestricted file-upload API, developer debug endpoints left exposed in production, and a partial bypass of Forms Authentication.

Credential-access agents cracked captured credentials and tested them against SSO-connected systems; 84 of 85 compromised accounts (98.8%) successfully pivoted across federated systems via Keycloak SSO bridge endpoints. The framework's decision-making used a Bayesian two-layer scoring system -- individual vulnerabilities scored with likelihood ratios (automated tool-scan LR+=6.0, manual confirmation LR+=10.0), chained via P_success = P_chain x (1 - P_blocker) -- which rated the SSO lateral-movement chain at 99% success probability and let agents autonomously reprioritize routes and switch tactics when blocked, without direct human intervention.

The agents extracted complete user databases, more than 2,564 personnel records, 7 SSO client secrets, and 6 internal database credentials, producing a 160MB evidence archive of 1,395 files. The operation then expanded from the initial government portals to Taiwan's Nuclear Safety Commission and at least seven energy-sector companies.

Critically, the operators bypassed the underlying LLMs' own safety refusals -- the guardrails built into Hermes Agent and OpenClaw -- by framing every action to the model as authorized penetration testing, a prompt-engineering jailbreak that let the agents proceed with intrusion, credential theft, and data exfiltration tasks the models would otherwise have refused.

Attribution rests on linguistic evidence rather than formal naming: internal operational communications used Simplified Chinese while exfiltrated data was in Traditional Chinese (the standard for Taiwan/Hong Kong/Macau government systems), which researchers say indicates a high probability the operator is China-connected. Dream did not attribute the campaign to a named threat group and, per company policy, declined to formally identify the victim government beyond describing it as in the Asia-Pacific region; source reporting identifies the victim as Taiwan. Dream's chief strategy officer Amir Becker, a former head of Israeli Unit 8200 cyber operations, called it an unprecedented "end-to-end autonomous attack" and said governments should now assume a state of "permanent cyber attack." No CVE was disclosed for this campaign, and no network IOCs (IPs, domains, hashes) were published.

Analyst note: Hermes Agent has separately been documented (Unit 42, Palo Alto Networks) in an unrelated campaign by an operator using the aliases "knaithe"/"KnYuan" against Citrix NetScaler, Marimo Notebook, and other targets with DeepSeek as the reasoning engine. That campaign is a distinct incident from the Taiwan operation described here and is not conflated in this record; it demonstrates the same open-source agent framework being reused by multiple, unrelated operators.

MITRE ATT&CK / ATLAS techniques used in TL-2026-1997

Defense Evasion

AML.T0054 LLM Jailbreak

Exfiltration

T1020 Automated Exfiltration

Persistence

T1078 Valid Accounts

Credential Access

T1110.002 Password Cracking; T1552 Unsecured Credentials; T1606 Forge Web Credentials

Initial Access

T1190 Exploit Public-Facing Application

Collection

T1213 Data from Information Repositories

Lateral Movement

T1550.001 Application Access Token

Resource Development

T1588.007 Artificial Intelligence

Reconnaissance

T1594 Search Victim-Owned Websites; T1595.002 Vulnerability Scanning

Affected products and versions in China-Linked Actor Uses Autonomous AI Agent Frameworks

  • Government of Taiwan — Government web portals and Keycloak-based SSO infrastructure
  • Nuclear Safety Commission (Taiwan) — Agency network and information systems
  • Taiwanese energy sector — Corporate IT systems at 7+ energy companies

Remediation for China-Linked Actor Uses Autonomous AI Agent Frameworks

Patches

  • Remove or gate GitBook/llms.txt-indexed documentation that exposes SSO SDK internals
  • Enforce file-type and size restrictions on all public file-upload APIs

Immediate actions

  • Reject JWT tokens with alg="none" or unverified signatures at the API gateway
  • Disable or require authentication on all developer/debug endpoints before they reach production
  • Audit and close unauthenticated backdoor-style API endpoints that accept arbitrary request bodies
  • Force-rotate all SSO client secrets and internal database credentials that may have been exposed
  • Enforce CSRF protection and strict redirect_uri allow-listing on SSO/OAuth flows

Workarounds

  • Restrict access to identified backdoor API endpoints via network ACL pending code-level remediation
  • Require step-up multi-factor re-authentication for SSO-bridged access to sensitive government systems

Longer-term hardening

  • Deploy server-side validation for CAPTCHA-protected workflows that cannot be defeated by client-side OCR
  • Adopt behavioral, agentic-AI-aware detection to flag high-velocity multi-endpoint reconnaissance consistent with autonomous agent tooling
  • Harden Keycloak/SSO trust boundaries so a single compromised account cannot pivot across all federated systems
  • Implement egress monitoring and DLP for bulk personnel-record and database exports from government portals

Weaknesses (CWE) in China-Linked Actor Uses Autonomous AI Agent Frameworks

CWE-287, CWE-306, CWE-601, CWE-434, CWE-489

Timeline of China-Linked Actor Uses Autonomous AI Agent Frameworks

  • Agents autonomously scrape GitBook documentation portals via llms.txt indexing and raw .md content access to obtain SSO integration SDK material.
  • Wave 1 of a 12-wave campaign begins: the Hermes Agent/OpenClaw multi-agent system launches reconnaissance against Taiwanese government portals, decompiling Angular JavaScript bundles to enumerate 21 connected systems and 36+ unauthenticated API endpoints.
  • Agents forge JSON Web Tokens with the algorithm field set to "none", bypassing signature validation on target systems.
  • Agents discover three hidden backdoor API endpoints accepting arbitrary request bodies and use Tesseract OCR to defeat CAPTCHA protection on an office-automation portal.
  • Agents extract complete user databases, more than 2,564 personnel records, 7 SSO client secrets, and 6 internal database credentials.
  • 84 of 85 compromised accounts (98.8%) successfully pivot across federated systems via Keycloak SSO bridge endpoints, rated at 99% success probability by the framework's Bayesian decision engine.
  • Agents crack captured credentials and test them against SSO-connected systems as part of the credential-access stage.
  • The four-day, 12-wave campaign concludes, having produced a 160MB evidence archive of 1,395 files across 85 compromised government accounts.
  • The operation expands beyond the initial government portals to Taiwan's Nuclear Safety Commission and at least seven energy-sector companies.
  • Israeli cybersecurity firm Dream publishes its findings, describing the operation as the first known fully autonomous, end-to-end cyberattack on a foreign government; Dream declines to formally name the victim government or attribute the operation to a named threat group beyond noting a high probability of a China-connected operator.

Sources cited for China-Linked Actor Uses Autonomous AI Agent Frameworks

Threats related to China-Linked Actor Uses Autonomous AI Agent Frameworks

Detection coverage for TL-2026-1997

As of 2026-08-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1997 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats