AI Agents Crack 85 Government Accounts and Steal 2,500+ Personnel Records

A Dream Research Labs report describes a near‑autonomous intrusion campaign in July 2026 that used AI‑driven agent frameworks (Hermes and OpenClaw) to enumerate systems, exploit exposed APIs and debug endpoints, bypass CAPTCHAs, perform credential spraying and SSO pivots (98.8% pivot rate), and exfiltrate at least 2,564 personnel and legal records while capturing secrets and internal credentials; defenders are advised to prioritize API exposure, JWT verification, SSO trust boundaries, MFA, and credential‑spray protections.