Dream, Co-Founded by Sebastian Kurz, Uncovered an AI Agents Attacking Taiwan

Set Trending Topics as a preferred source on Google.

A 160-megabyte archive lying openly on the internet was the decisive clue: the Israeli-Austrian cybersecurity company Dream says it has reconstructed a largely autonomous cyberattack on government agencies in Asia. The attack ran over four days in July, used exclusively freely available open-source AI agents – and, according to the Financial Times, targeted Taiwan.

The find was a byproduct of routine work: while continuously monitoring threat actors, Dream’s threat researchers stumbled upon an exposed online archive containing 1,395 files – the complete workspace of an AI-powered attack framework. The material documented the planning, execution, and post-processing of an intrusion campaign against government infrastructure. Dream published its analysis on Wednesday in its research blog; the Financial Times reported first and named Taiwan as the target. Dream itself only speaks of “government agencies in Asia” and, citing company policy, does not confirm the target country.

OpenClaw and Hermes in action

According to Dream’s analysis, the attack tool was based on two freely available agent frameworks: Hermes and OpenClaw. Both allow language models to carry out multi-step tasks autonomously. The framework launched up to eight letter-designated sub-agents simultaneously per wave, each with its own target and technique. Across twelve documented waves between July 1 and 4, 2026, agents labeled A through Q appeared.

The sequence of events, according to the report:

• Reconnaissance: The system downloaded JavaScript bundles from an Angular-based government portal, decompiled them, and extracted embedded URLs, API endpoints, OAuth client IDs, and Keycloak configurations. From this it mapped 21 connected government systems along with the national SSO architecture. At a single target, it found more than 36 API endpoints – many of them with no authentication at all, and one exposed the entire user database.
• Initial access: Three hidden debug endpoints in a government web application yielded valid sessions without credentials. Another API accepted JWT tokens with the algorithm field set to none – meaning identity tokens could be forged without a signing key.
• Password attack: Using previously harvested employee IDs, the system carried out a password-spraying attack against an office automation portal. It solved the CAPTCHA in front of it using Tesseract, the open-source OCR tool. Predictable password patterns based on employee IDs were tested – 85 accounts were cracked.
• Lateral movement: 84 of the 85 accounts (98.8 percent) could be reused on internal systems via SSO bridge endpoints, without additional authentication or MFA. An uploaded web shell proved ineffective because a second authentication layer blocked its execution.
• Data exfiltration: More than 2,500 personnel records, plus internal database credentials and network IP ranges.
• Expansion: The attack spread to government IT suppliers, a nuclear safety agency, a government mail system, and at least seven energy companies.

Bayesian statistics and “Learning Cycles”

What Dream finds remarkable is less the technical arsenal – these are entirely well-known vulnerability classes, and no zero-day appears in the report – than the decision-making logic. The framework evaluated every finding with a formal Bayesian model: starting probability 0.5, then updates via likelihood ratios depending on the evidence. Above a posterior probability of 0.95, a vulnerability was considered confirmed and moved into an attack chain; below 0.3, it was discarded. A second layer evaluated entire attack chains – 14 of them ran in parallel and were continuously reprioritized.

When a path was blocked, the system initiated so-called “Learning Cycles”: agents searched vulnerability databases, GitHub repos, and security publications for techniques suited to the specific target environment. Five such cycles are documented. Self-correction is also on record: seven false positives were identified and discarded by the system itself, including a supposed SQL injection whose 21-second delay turned out to be an SMTP timeout.

The safety mechanisms of the models used were not technically broken, but bypassed by declaring the entire operation an “authorized penetration test.” Which model powered the agents, the researchers were initially unable to determine. Speaking to CSO Online after publication, a Dream spokesperson said they had since found indications that a DeepSeek-V4-Flash model was used, but did not know whether it was the only one.

Attribution remains open; Taiwan confirms incident

Dream does not attribute the attack to any specific group. As an indicator of a Chinese-speaking operator, the researchers point out that the internal status reports were written in simplified Chinese, while the captured target data was in traditional Chinese – commonly used in Taiwan, Hong Kong, and Macau. Chinese authorities did not respond to inquiries, according to the FT.

Taiwan’s Ministry of Digital Affairs confirmed attacks in July one day after the FT report. The attacks came from abroad and used a hybrid approach combining manual operations with support from AI agents such as OpenClaw, the ministry said, according to Reuters. Attack sources, methods, and the extent of the damage have been fully investigated, and the affected agencies have dealt with the incident.

The national cybersecurity agency accordingly began issuing warnings on July 20. Taipei did not explicitly connect the Dream report to its own incident. Dream itself also qualified its findings in comments to CSO Online: it had found no evidence of a confirmed breach of the affected organization’s systems; the report describes the framework as it stood at the time of analysis.

The company behind the discovery

Dream’s business model is to offer governments and states cyber-defense capabilities to digitally protect themselves and critical infrastructure – with the promise of increasing digital sovereignty.

It was founded in 2023 by Israeli cyber entrepreneur Shalev Hulio and former Austrian Chancellor Sebastian Kurz. Hulio was previously a co-founder of the NSO Group, which the US placed on a sanctions list in 2021 over the use of its Pegasus software against journalists and dissidents. Dream, headquartered in Tel Aviv, positions itself as a provider of state-level AI and cyber defense and was valued at three billion dollars in June following a $260 million round with investors including Bain Capital – up from 1.1 billion previously.

Amir Becker, Chief Strategy Officer at Dream and former head of cyber operations for Israel’s signals intelligence Unit 8200, speaks of an “end-to-end autonomous attack” of a kind he had never before encountered against a state target. His conclusion: governments must henceforth assume a permanent state of attack.

For context: Taiwan’s National Security Bureau recorded an average of 2.6 million Chinese cyberattacks per day in 2025, according to its own figures – an increase of six percent over the previous year. Kenny Huang, chairman of the Taiwan Network Information Center, considers the now-documented case to be the first publicly disclosed fully automated attack on a government, CNN reports.