OpenClaw-Based Multi-Agent AI Framework Compromises Government Systems and Exfiltrates Thousands of Records

Severity

Medium

Cybersecurity researchers have uncovered a multi-agent AI framework that was used to compromise government organizations in Asia, crack employee credentials, and exfiltrate thousands of personnel records. The framework utilized Hermes and OpenClaw agents, according to Dream Research Labs.

Researchers identified a 160 MB operational archive containing 1,395 files generated over approximately four days of activity, from July 1 to July 4, 2026.

How?

The framework coordinated up to eight autonomous sub-agents across 12 attack waves, assigning agents different targets and reconnaissance or exploitation tasks. It used Bayesian scoring to prioritize 14 attack chains and could enter “Learning Cycles” to search vulnerability databases, GitHub repositories, and security publications when initial techniques failed.

The framework began by analyzing JavaScript bundles from an Angular-based government portal, exposing API endpoints, OAuth client IDs, Keycloak configuration data, and other authentication information. Further reconnaissance identified 21 connected government systems, multiple SSO and OpenID Connect endpoints, RSA keys, and authentication flows.

More than 36 API endpoints were mapped, including unauthenticated endpoints that exposed employee names, departments, and SSO account identifiers. The framework also identified developer-style authentication endpoints that could return authenticated sessions.

The agents then conducted automated credential-spraying attacks against an office automation portal. Using Tesseract OCR to solve CAPTCHA challenges and testing predictable password patterns, the framework successfully compromised 85 accounts.

A separate authentication weakness allowed the agents to bypass JWT signature validation by setting the token’s algorithm field to none, causing the application to accept tokens without a valid signature. The compromised credentials were then tested against connected systems through SSO bridges, with 84 of the 85 accounts successfully accessing an internal information system, representing a 98.8% success rate.

The activity resulted in the exfiltration of at least 2,564 personnel records, including 1,409 employee entries, 916 user records obtained through an unauthenticated API, and 239 legal-professional records from a Ministry of Justice endpoint. The archive also contained internal network ranges, database credentials, SSO client secrets, and a complete JSON user export from one departmental system.

The agents attempted to upload a web shell through an unrestricted file-upload interface, but a Forms Authentication layer prevented its execution. The framework was able to recognize the failed attempt and pursue alternative attack paths.

Dream Research Labs noted that the framework went beyond conventional automated scanning. Its agents could verify findings, generate reports, reassess unsuccessful attack paths, and retest potential vulnerabilities. The activity demonstrates how multi-agent AI systems can reduce the time and expertise required to coordinate complex intrusion operations.

Conclusion

The incident highlights the growing risk of AI agents being used to automate and coordinate cyber attacks. The ability to perform reconnaissance, adapt to failed exploitation attempts, conduct credential attacks, and collect sensitive information across multiple systems allows attackers to carry out complex operations with greater speed and scale.

For defenders, key priorities include securing unauthenticated APIs, protecting exposed authentication and development endpoints, enforcing proper JWT validation, implementing MFA across SSO-connected services, and monitoring for credential-spraying activity.

Source

https://gbhackers.com/multi-agent-ai-framework-compromises-government-systems/