← News
/DISPATCH · 2026-08-17

Near-autonomous AI agents go operational: Hermes/OpenClaw hits Taiwan government + nuclear safety agency and 30+ US water utilities

Israeli firm Dream reports suspected China-nexus operators used a near-autonomous AI agent framework on open-source Hermes/OpenClaw. In 12 waves over 1-4 July they ran up to 8 sub-agents in parallel, compromising Taiwan government email, a nuclear safety agency, and 7 energy firms. Concurrently, PLCs at 30+ small-city US water utilities were breached; FBI and private-sector analysis attributed that activity to Iran.

Incident overview

From 1-4 July 2026, suspected China-nexus threat actors used a near-autonomous attack framework built on open-source AI agent stacks Hermes Agent and OpenClaw against Taiwan government websites, government email, a nuclear safety agency, several IT supply-chain vendors, and at least seven energy companies. Dream's after-action report: 12 waves in four days, up to eight sub-agents per wave in parallel for recon, vuln research, credential attacks, and data theft, with tactics retuned from execution feedback. Independently, water utilities in 30+ small Minnesota cities and targets in nearly 12 US states were compromised. FBI Cyber Assistant Director Brett Leatherman named critical infrastructure the top concern.

Technical details

Hermes Agent is an open-source autonomous attack assistant that executes commands without waiting for a human. Researchers paired it with models such as DeepSeek—weaker safety constraints in Chinese-language settings—as the reasoning engine. OpenClaw lets operators remotely delegate autonomous tasks over IM channels. Together the multi-agent system split independent roles per wave: recon sub-agents ran continuous Nmap, Shodan, and similar scans; vuln-research sub-agents queried public CVE and Exploit-DB resources and downloaded exploit code; credential sub-agents ran password spraying and brute force; exploit sub-agents executed at the vuln. On blockage the system switched tactics itself rather than waiting for remote commands—tempo and the decision loop compressed. Palo Alto Unit 42's late-July report recorded a separate op that wired a DeepSeek model into the same Hermes framework, scanned 460+ internet-exposed systems over Telegram, and took 14.

No evidence-level link between the US water cases and this autonomous-AI pattern. Infected systems were mostly small community plants with PLCs on the public internet using default or weak credentials—not high-difficulty targets that need AI assist. Side-by-side the two incidents still show two distinct critical-infrastructure attack surfaces: targeted high-end autonomous ops and high-volume low-skill password issues, concurrent.

Impact

Dream: Taiwan campaign took at least 85 government accounts, leaked 2,500+ personnel records, and extended into the nuclear safety agency and energy sector. Anthropic's November 2025 Claude Code abuse case showed AI already completing 80-90% of attack actions independently, remaining work under light human supervision. This month's events move that pattern from demo into ops: the high bar for targeted intrusion is being flattened by open-source models and agent ecosystems.

Mitigation

Sources