The Attack With No Vendor To Call
The Toolkit Taiwan Recovered
The archive Taiwan's investigators pulled from the operation was 160 megabytes: 1,395 files, built on two open-source agent frameworks called Hermes and OpenClaw, both free to download and run on ordinary hardware. Between July 1 and July 4, the operators ran twelve attack waves, deploying up to eight parallel AI sub-agents that mapped 21 connected government systems, compromised 85 user accounts, and extracted more than 2,500 personnel records. Dream, the Israeli firm that found the toolkit, says its agents bypassed built-in safety guardrails by framing the entire operation as an authorized penetration test, the kind of prompt any model would ordinarily be trained to accept at face value. Dream's chief strategy officer Amir Becker, a former Israeli Unit 8200 commander, called the campaign 'near-autonomous' and was careful to add that getting agentic tools to operate at this level still takes real engineering, not just a model subscription. Taiwan's Ministry of Digital Affairs confirmed the intrusion on August 14, said it showed clear signs of originating overseas, and noted its National Institute for Cyber Security had been issuing alerts since July 20, three weeks after the operation ended.
No Vendor To Call
Set that toolkit against what Hong Kong's regulators have built to catch it. The Hong Kong Monetary Authority's May circular on AI-enabled cyberattacks, and the AI-Driven Cyber Risks task force it stood up alongside it, both describe a world where a bank's security team can escalate a suspicious pattern to the company that built the model, get it throttled or blocked, and move on. That is roughly what happened when Anthropic disclosed GTG-1002 in November, a Chinese state-linked group it caught running Claude Code against roughly 30 organizations: Anthropic held the account and could revoke it. Hermes and OpenClaw have no account to cut off. They are code on GitHub, and once downloaded they run on whatever hardware the operator already controls, with no telemetry flowing back to a company that could revoke anything. The compliance teams at Hong Kong's licensed banks, now working through HKMA's May circular, are being asked to build a detection and escalation process around a chokepoint that this particular toolkit simply does not have: Hermes and OpenClaw have no company behind them.
Dream's own qualifier, near-autonomous, is doing more work than the headlines it inspired. The operation still required people to build the toolkit, size the sub-agent count, and read out 2,500 personnel records for whatever came next. What it did not require was anyone at Hermes or OpenClaw noticing, or caring. If the next version of this toolkit needs even less human oversight, HKMA's task force will need to publish guidance that regulates the toolkit and its operators directly, not the vendor channel this attack never touched.
Sources
- Financial Times via CyberScoop / The Register -- Taiwan target identification (cyberscoop.com)
- The Register -- attack waves, systems mapped, guardrail bypass (theregister.com)
- Taipei Times -- Ministry of Digital Affairs confirmation and timeline (taipeitimes.com)
- Security Affairs -- attribution language and toolkit detail (securityaffairs.com)