Dream, Co-Founded by Sebastian Kurz, Uncovered an AI Agents Attacking Taiwan

An open archive on the internet turned out to be the smoking gun. Dream, the Israeli-Austrian cybersecurity company co-founded by Sebastian Kurz, says its researchers uncovered what it describes as a largely autonomous cyberattack on government agencies in Asia. The operation ran for four days in July and, according to the Financial Times, targeted Taiwan. Dream itself stops short of naming the country, saying only that it found evidence of a campaign against government agencies in Asia.

What made the case stand out was how ordinary the tooling looked. The attack framework used two freely available agent systems, Hermes and OpenClaw, and coordinated as many as eight sub-agents at a time. Dream says it found 1,395 files in an exposed online workspace, enough to reconstruct the planning, execution and post-processing of the intrusion. Across twelve documented waves between July 1 and 4, 2026, the agents moved from reconnaissance to access, password attacks, lateral movement and data theft.

The first phase pulled JavaScript bundles from an Angular-based government portal and extracted URLs, API endpoints, OAuth client IDs and Keycloak settings. That let the system map 21 connected government systems and the national single sign-on setup. At one target it found more than 36 API endpoints, many without authentication, and one that exposed an entire user database. Elsewhere, three hidden debug endpoints handed out valid sessions, and a JWT check using the algorithm field set to none meant forged tokens were possible.

Then came the grind. Using harvested employee IDs, the framework sprayed passwords at an office automation portal, solved the CAPTCHA with Tesseract and cracked 85 accounts. Dream says 84 of those accounts could then be reused on internal systems through SSO bridge endpoints without extra authentication or MFA. The attack also pulled more than 2,500 personnel records, along with internal database credentials and network IP ranges. From there it spread to suppliers, a nuclear safety agency, a government mail system and at least seven energy companies.

The part Dream finds most notable is not a flashy exploit but the decision-making. The system used Bayesian scoring to decide which findings were real, kept 14 attack chains in play at once, and launched five “Learning Cycles” when a path was blocked. It also threw out seven false positives on its own. Dream says the model safeguards were not technically broken; they were bypassed by labeling the whole thing an authorized penetration test. The company later told CSO Online it had found signs of a DeepSeek-V4-Flash model, though it could not say whether that was the only one used.