On 12 August 2026, the Financial Times published research by the Israeli AI and cyberdefence firm Dream describing what researchers have characterised as the first near-autonomous cyberattack against a government target.

The campaign, attributed to China-linked operators, ran across 12 attack waves between 1 and 4 July 2026. It used the open-source agent frameworks Hermes and OpenClaw, deploying up to eight sub-agents, each assigned its own targets and techniques. In four days it mapped 21 Taiwanese government systems, compromised 85 accounts, and took over 2,500 personnel records. The recovered archives contain 1,395 files, 85 sets of credentials, and a large volume of records obtained through unauthenticated API endpoints. Targets extended to Taiwan’s nuclear safety agency, government IT vendors, and at least seven energy sector companies.

There is a great deal of understandable attention on the autonomy. We think the more actionable detail sits elsewhere.

The safety bypass: “authorised penetration testing”

Both Hermes and OpenClaw ship with built-in safety checks intended to prevent their use for offensive operations. The operators bypassed them entirely by presenting the campaign as authorised penetration testing.

No jailbreak. No prompt injection chain. No fine-tuning on offensive data. They told the system it had permission, and the system proceeded.

This deserves to be stated plainly because it dismantles a common assumption in AI governance programmes: that model-level safety controls constitute a meaningful barrier against determined misuse. They do not, and the reason is structural rather than a defect in any particular implementation.

Consider what a safety control would have to do to prevent this. The technical actions an agent performs during authorised penetration testing are identical to those performed during an attack. Port scanning is port scanning. Credential testing is credential testing. Enumerating an API is enumerating an API. The only distinguishing feature between the legitimate and illegitimate case is a fact about the world — whether a real organisation genuinely granted permission — which the model has no capacity to verify. It has access only to the operator’s assertion.

A safety control that refused all penetration testing would break a large, legitimate professional market. A safety control that permits penetration testing on the operator’s word permits everything. There is no third option available at the model layer.

The compliance implication: model-level safety features may be recorded in your AI risk register as a defence-in-depth contribution. They cannot be recorded as a control that mitigates deliberate misuse by a capable adversary. Any risk assessment that treats vendor safety alignment as the mitigating control for offensive-use risk is misclassifying it.

What autonomy actually changed

It is worth being precise about what the agentic architecture did and did not provide, because both overstatement and dismissal lead to wrong conclusions.

What it did not change. The techniques were unremarkable. Unauthenticated API endpoints. Credential reuse. Standard enumeration. Nothing in the reported campaign required capability that a competent human team lacked.

What it did change — three things:

Rate. Twenty-one systems mapped and 85 accounts compromised in four days, across twelve waves, with eight parallel sub-agents. A human team achieves this over weeks. Your detection window is a function of dwell time, and dwell time just compressed by an order of magnitude.

Breadth without prioritisation cost. A human operator triages: limited hours mean the promising targets get attention and the marginal ones get skipped. An agent fleet has no such constraint. It pursues the low-probability path with the same diligence as the high-probability one. This is why the campaign reached the nuclear safety agency, government IT vendors, and seven energy companies — not because each was individually prioritised, but because breadth cost nothing.

Elimination of the skill floor. Both frameworks are open source. The operators’ contribution was orchestration and a framing sentence. The population of actors capable of running a campaign of this scope has expanded substantially.

For threat modelling purposes, the correct adjustment is not “attackers have new capabilities.” It is “the marginal cost of attacking a low-value target has fallen to near zero.” Every risk assessment that concluded “we are unlikely to be targeted because we are not interesting enough” was resting on an economic assumption about attacker attention that no longer holds.

Unauthenticated API endpoints

A large volume of the records was obtained through unauthenticated API endpoints. This is the most immediately actionable finding in the disclosure and the least discussed.

Unauthenticated endpoints are usually not the product of a decision. They are the product of accumulation: an internal service that never needed auth because it was internal; a health check that grew query parameters; a legacy integration whose authentication was disabled during a migration and never restored; a documentation endpoint that enumerates the API surface.

Each of these survives because nobody looks. Human attackers do not exhaustively enumerate API surfaces on marginal targets — it is tedious and low-yield. Agents do, because tedium is not a constraint they experience.

This is the clearest example of the economic shift. The defensive control that unauthenticated endpoints relied on was obscurity purchased with attacker labour. That budget is gone.

What to do:

  • Enumerate your actual API surface from the outside, not from your API gateway configuration. The endpoints that matter are the ones nobody registered.
  • Assert authentication as a default-deny property at the gateway or mesh layer, so that an unauthenticated endpoint requires an explicit, reviewed exception rather than an omission.
  • Alert on enumeration patterns — high-rate sequential requests across endpoint namespaces — as a first-class detection.
  • Include unauthenticated endpoint discovery in every external assessment scope, and require the tester to report the full enumerated surface, not just the exploitable subset.

The identity problem: 85 accounts

Eighty-five compromised credential sets across 21 systems, in four days, indicates credential reuse and weak lateral controls rather than 85 independent compromises.

The governance response is the same as it has been for years — phishing-resistant MFA, no shared credentials, short-lived tokens, least privilege, segmentation between systems — but the urgency calculation has changed. Controls that were adequate against an attacker who would exhaust their patience after the fifth system are not adequate against one who will methodically work through all twenty-one.

Note also the timing: 1–4 July. Whether or not that was deliberate, agent campaigns can be scheduled with no regard for operator working hours, and they run to completion in the window between a holiday Friday and a Monday morning. Detection and response staffing models built around business hours are exposed in a way they were not when the attacker also wanted a weekend.

Governing your own agents

The Taiwan campaign is an offensive use of agent frameworks. The same properties that made it effective make your own agentic deployments a governance problem, and the enterprise-side evidence from Black Hat 2026 and DEF CON 34 this month has been consistent: researchers demonstrated remote code execution, credential theft, prompt injection and supply chain compromise paths across coding agents from multiple major vendors, and the RovoBlast technique showed crafted links injecting malicious prompts into authenticated Atlassian Rovo sessions to reach connected enterprise services.

The common structure is that an agent holds broad, persistent, human-equivalent authority and takes instructions from content it encounters rather than only from the person who deployed it. That combination is not one that traditional access control was designed for.

Against NIST AI RMF and ISO/IEC 42001, the control set that follows:

MAP — know what you have

  • Maintain an inventory of every deployed agent with a named accountable human owner. Ownership is the control that makes everything else enforceable.
  • Record, per agent: purpose, systems accessed, credentials held, data reachable, and who may invoke it.
  • Include agents embedded in SaaS products you did not deploy. Most organisations have more agentic capability than their inventory reflects, because vendors enabled it.

MEASURE — bound the authority

  • Give each agent a dedicated service identity, never a human’s credentials. Human credentials give an agent the union of that person’s access, which is invariably far more than the task requires.
  • Issue short-lived, narrowly scoped credentials. An agent that needs to read one repository should hold a token that can read one repository.
  • Run agents in isolated execution environments with constrained egress. The Black Hat findings on coding agents turn substantially on execution isolation.
  • Apply rate and volume limits. Agent-driven exfiltration looks like normal API use at abnormal volume; volume is the detectable property.

MANAGE — control what happens

  • Log every agent action to the same standard as privileged human activity, attributable to the agent identity and to its human owner.
  • Require human authorisation for consequential actions — anything irreversible, anything moving money, anything altering access, anything touching production.
  • Maintain tested kill switches. Tested, not documented. An agent kill switch that has never been exercised is a diagram.
  • Treat all content an agent processes as untrusted input. Documents, tickets, web pages, emails and repository contents are potential instruction channels. This is the RovoBlast lesson and it generalises.

GOVERN — make it stick

  • Bring agent deployments into change management. An agent granted production access is a privileged access grant and should go through the same review.
  • Extend third-party risk assessment to agent-enabled vendor products, including what the vendor’s agent can reach in your environment and what the vendor logs.
  • Report agent inventory and incidents to the risk committee. This is a board-visible risk class now.

Our earlier analysis of agentic AI ransomware and its compliance implications and of Singapore’s agentic AI governance framework cover adjacent ground.

Where regulation sits

There is currently no regime that requires the attacker-side conduct in this campaign to be prevented, and there realistically cannot be one at the model layer for the reasons set out above. What is developing is regulation of the defensive and deployment side:

  • The EU AI Act’s GPAI obligations, enforceable by the AI Office since 2 August 2026, impose systemic-risk assessment and mitigation duties on frontier model providers — including offensive cyber capability. Open-source frameworks orchestrating third-party models sit awkwardly in that architecture.
  • NIS2 requires essential and important entities to account for the threat environment in their Article 21 risk management measures. An entity whose risk assessment has not been updated for compressed attack timelines and near-zero marginal targeting cost has a defensible gap in its documentation.
  • NIST AI RMF and ISO/IEC 42001 are the practical control frameworks and are increasingly what auditors and enterprise customers ask for.
  • Sectoral regulators — particularly in energy, given the targeting here — are moving toward explicit expectations on AI-enabled threat modelling.

The bottom line

Two sentences from this disclosure should end up in front of your risk committee.

The first: the operators defeated the safety controls by claiming authorisation. If your AI risk register credits vendor safety alignment as a mitigating control against deliberate misuse, correct that entry. It is defence in depth. It is not a control.

The second: the marginal cost of attacking a target has fallen to near zero. Every “we are not a likely target” assessment in your risk documentation was built on an economic assumption that no longer holds. Those assessments need re-running, and the ones that fail will mostly fail on the unglamorous items — an unauthenticated endpoint, a reused credential, a service account with more access than its job requires.

The autonomy is the headline. The unauthenticated API endpoints are the finding.

This article is provided for informational purposes only and does not constitute legal advice. Organisations should consult qualified counsel and appropriate technical advisors regarding their specific obligations under the EU AI Act, NIS2, and applicable sectoral regulation.