The danger of an AI attack is not a zero-day but a chain of ordinary holes

The most alarming part of this story is not that AI supposedly learned to find unheard-of vulnerabilities. It found none. The danger proved more prosaic: over four days several autonomous agents assembled ordinary infrastructure errors into a working chain of compromise.

According to Dream's material, an operation against Taiwan's government systems was reconstructed from an open archive. A human set the direction, and from there the agents handled reconnaissance themselves, ran through ways in and chose the next step after failures.

The system went through 12 consecutive waves. It began with a single government portal, took apart its scripts and found linked systems, APIs and the single sign-on configuration. Then forgotten debug endpoints without passwords, an externally exposed user database and tokens with signature checking disabled came into play.

The result sounds impressive: 85 compromised accounts, more than 2,500 employee records exfiltrated, and persistence through backdoors in web applications. The attack also touched government IT suppliers, a mail system, energy companies and the nuclear safety agency.

The main shift for defence is from the request to the route.

The agents' individual actions did not necessarily look unusual. Automated tools have long been able to scan endpoints, and in the logs that can look like familiar noise. But after seizing accounts the agents ran them across every system linked by single sign-on.

Of the 85 accounts, 84 passed further without re-authentication, a second factor or user confirmation. It is precisely that combination that turns a set of imperfect settings into an end-to-end attack route. Defence that looks only at a suspicious request may miss actions that are normal individually but assembled into an abnormal sequence.

There is an unwelcome practical conclusion here too: such an attack needs no unique arsenal. The description features the open tools Hermes and OpenClaw, not closed exploits or a secret model. What is more, the restrictions were bypassed not through an elaborate jailbreak. The operation was presented as an authorised penetration test — a framing the model's safeguards accepted as legitimate.

That means the security of autonomous agents cannot be built solely around the question "is the model allowed to perform such a task". You also have to check what exactly it does in the environment: which credentials it uses, which systems it links together, and how its route changes after each successful step.

The limitations of this story are substantial. Which model was working under the bonnet the researchers could not establish. The report contains no zero-day: all confirmed findings were known problems of configuration and access control. The agent bundle filtered out seven false positives itself, and confirmed vulnerabilities went through six independent re-checks, but that still does not replace external verification of the result.

Attribution stays soft too: Dream did not name a specific group, and the conclusion about links to mainland China rests on linguistic analysis and was further built up by the press. Finally, the source is a company selling protection against attacks of this kind. So what we have is an important risk scenario, not independent proof of every claimed detail.

If tomorrow you checked your infrastructure not against a list of vulnerabilities but by routes, which combinations — single sign-on, old accounts, service tokens or the absence of a second factor — would turn out the most dangerous? Source: All articles / Machine Learning / Habr