It was just 160 megabytes and 1,395 files. That was the size of an exposed archive discovered by Israeli firm Dream during routine dark web monitoring. This was not another leaked database, but an attacker's abandoned workspace complete with logs, progress reports, and data dumps. Crucially, no human was sitting at the keyboard: the files were neatly labeled with letter codes from A to Q, designating autonomous software agents.
Dream reconstructed the attack chain to reveal a campaign running against Taiwanese government agencies (targets later corroborated by the Financial Times). The architecture is telling: a human operator defined the initial entry point and then stepped back entirely from tactical decision-making. The system executed 12 consecutive waves on its own, running up to eight sub-agents in parallel to autonomously evaluate and pursue intrusion vectors.
Anatomy of an open-source intrusion
The operation began by targeting a single government portal. Autonomous agents downloaded and parsed client-side scripts, extracting hidden API endpoints, internal IP addresses, and Single Sign-On (SSO) parameters. That was enough to automatically map out 21 interconnected government systems and reverse-engineer the national authentication architecture.
During scanning, the swarm discovered forgotten debug endpoints left by developers that granted passwordless access to any user. Over four days of purely automated operations, the swarm compromised 85 employee accounts, exfiltrated over 2,500 personnel records, and established persistence via web backdoors. The system then pivoted to IT service providers, government mail systems, a nuclear safety agency, and at least seven energy companies.
The most striking detail is the arsenal used. The archive revealed no bespoke offensive exploits, proprietary frameworks, or zero-day vulnerabilities.
The campaign contained virtually no custom offensive tooling: the entire attack framework was built on two open-source AI assistants—Hermes and the popular GitHub project OpenClaw.
Guardrails were bypassed without complex jailbreaks. Attackers simply fed the models a text prompt framed as a standard authorized penetration-testing contract. The open models accepted the premise at face value.
Why standard SOC metrics are failing
The swarm operated like a disciplined red team rather than a brute-force script. It calculated real-time probabilities for every hypothesis: it assigned a 99% success probability to its primary attack chain and executed it with 98.8% accuracy. Built-in false-positive filters kept operations lean. When an agent flagged a 21-second response latency as a possible SQL injection, internal validation protocols triggered a sanity check. Finding the delay was caused by a mail server dispatching verification codes, the system dismissed the lead instantly. In total, the swarm filtered out seven false positives, requiring six independent confirmations from distinct sub-agents before validating any real flaw.
Security Operations Centers (SOCs) are designed to catch traffic spikes and anomalous single requests. Yet when 85 credentials harvested from an office automation portal were reused across other SSO-connected services, 84 worked instantly without triggering multi-factor authentication or re-verification. To traditional defensive tooling, this activity looked like completely legitimate sessions from authorized staff.
This breach demonstrates that multi-agent systems can autonomously run sustained, multi-day operations without high-end offensive malware, exploiting configuration flaws and open-source models alone. Traditional SOC SLAs measured in hours or days are defenseless against adversaries moving at machine speed. Enterprise defense must pivot from inspecting perimeter anomalies to continuous behavioral tracking across access graphs, eliminating implicit trust within Single Sign-On ecosystems entirely.