Threat actors deployed AI agents to target government systems and exploit tools

The week

The week had 2 incidents, down 2 from 4, including 2 real-world incidents, down 1 from 3. Threat actors deployed a multi-agent framework built on Hermes and OpenClaw in attacks against Taiwanese government systems, where investigators recovered operational workspaces documenting multiple attack waves. In another incident, a threat actor configured Hermes Agent with DeepSeek as its reasoning engine to facilitate terminal access and exploit Langflow and n8n using integrated tools and custom red-team skills. The week also had 32 disclosed vulnerabilities, up 26 from 6.

Written by a language model (gemini-3.5-flash-lite) from this week’s records only, and checked against the numbers above. Read the incident pages for the sources.