AI Agents Breached 85 Taiwan Government Accounts in Four Days

A four-day campaign run largely by machines

In early July, an attack framework built from freely available AI agent software spent four days working through Taiwanese government systems. It mapped 21 connected systems, cracked 85 user accounts and took about 2,500 personnel records, according to Dream, the Israeli security firm that found the operation11. The agents then spread to Taiwan's nuclear safety agency, government IT vendors and at least seven energy companies1112. On August 13, Taiwan's Ministry of Digital Affairs confirmed that government agencies had been hit by AI-assisted attacks from overseas. Its monitoring units flagged the "abnormal" activity, and the National Institute of Cyber Security issued alerts while it investigated12.

Two months later the case is still the main reference point for agentic attacks. It now appears in analysis of follow-on incidents such as suspected AI-agent intrusions at South Korean banks2, and in debates over when an AI agent's hack crosses the line into an act of war1. For enterprises, the details of how the campaign worked matter more than the headline. Almost nothing the agents did required new capability. What changed was the speed and scale at which they used existing techniques.

How the agents operated

Dream rebuilt the operation from an exposed online archive of about 160 MB and 1,395 files that the operators left behind166. The framework ran on two open-source agent projects, Hermes and OpenClaw, which are built to let large language models carry out multistep tasks on their own16. Neither tool was designed for offense. The concerning part is that the operators put together a working attack system from parts any developer can download16.

The framework ran up to eight sub-agents at once, each with its own target and technique, and carried out about a dozen attack waves between July 1 and July 46. Reconnaissance started at a single government portal. The agents decompiled its JavaScript and pulled out API endpoints, OAuth client IDs and Keycloak configuration data, which revealed the full single sign-on setup across 21 systems13. One target alone exposed more than 36 endpoints, many of them with no authentication at all6.

Getting in was surprisingly easy. Three hidden API endpoints reportedly handed out valid authenticated sessions without asking for credentials. Where a login was required, the agents used harvested usernames, solved CAPTCHAs and sprayed passwords built from predictable employee-ID patterns6. Cyber Magazine reports the CAPTCHAs fell to ordinary Tesseract OCR with 100% accuracy. Because there was no multi-factor authentication, the attackers could use 84 of the 85 cracked accounts13. The haul included more than 2,564 personnel records, six database credentials and seven single sign-on secrets3.

Dream says the framework's most notable feature was how it adapted. It scored possible attack paths by their odds of success, kept re-ranking 14 parallel attack chains, and ran "learning cycles" when blocked, searching vulnerability databases, GitHub and published research for new methods13. "When an approach gets blocked, it researches new techniques in real time and adapts," Dream executive Amir Becker told CNN1. The model's safety guardrails were bypassed by describing the work as an authorized penetration test, and Dream could not identify which model was running the agents197.

"Fully autonomous" or not: where the coverage splits

The biggest disagreement in the reporting is over how autonomous the attack really was. CNN called it what experts believe is the first fully autonomous attack on government agencies. It quoted Kenny Huang, chairman of the Taiwan Network Information Center, describing it as the first disclosed fully automated attack on a government11. Tom's Hardware and Benzinga used Dream's own phrase, an "end-to-end autonomous attack"1814.

Dream's published research and CyberScoop are more careful. They use "near-autonomous" and note that human tuning was still needed17. Taiwan's ministry described a "hybrid" model that combined manual operations with agents such as OpenClaw1115. Semgrep's Cris Thomas told the Guardian that a capable operator still chose the target, set the objective and gave the directive12. One technical analysis summed it up this way: the autonomy was in carrying out the attack, not in the whole operation6.

The careful reading is the right one, but it doesn't make the incident less important. Humans picked Taiwan and the goal, and the machines did the slow middle work of reconnaissance, credential attacks, lateral movement and pivoting. That middle work has always taken the most skilled labor, and it is now the part that is automated8. Dream put it bluntly: the cost of running a competent attack has collapsed, while the cost of defending against one has not11.

Attribution stays open on purpose

The second split is over who did it. Many headlines say "China-linked"1418, but the evidence is circumstantial. Dream found Simplified Chinese in the operators' internal communications and judged a China connection highly probable, but it did not name a group12. Illumio notes the notes switched between Simplified and Traditional Chinese8. Dream even declined to name the victim, saying only that it had notified an Asia-Pacific government, and the Financial Times identified Taiwan through a person familiar with the incident18. Taiwan's statement pointed to an "overseas source" without mentioning China12, and China's foreign ministry told CNN it was not familiar with the situation11.

The timelines also differ slightly. Dream dates the attack waves to July 1–4, while Taiwan's ministry said the abnormal activity it detected began July 20612. One reading is that July 20 is when Taiwan's monitoring caught it, not when the attack started6. Accounts of the aftermath differ too. Taiwan says the affected agencies have finished their response12, while Dream's description includes a backdoor and a persistent foothold inside state systems13.

Attribution is not a minor point. The Insider argues that open-weight models running on an operator's own servers leave no AI provider with a view of the traffic, which erodes one of the West's best ways of identifying attackers7. Forbes warns that the bigger risk is a government striking back before it knows whose agent hit it1.

The enterprise angle: your agent stack is their attack stack

For companies adopting autonomous agents, this case should change the conversation. The framework was built on OpenClaw, the same open-source assistant that businesses are installing, and Chinese cloud providers have been offering easy installation and cheap hosting for its agents15. Taiwan's Administration for Cyber Security had already told OpenClaw users to isolate their environments, minimize permissions, check third-party skills, use temporary credentials and require human sign-off for high-risk actions5. That is sensible advice for any company running agents, whether to protect against them or to keep its own agents in check.

Taiwan is also a test case for industrial agents. NVIDIA said in May that Advantech, Foxconn, Pegatron and Wistron were among the first to deploy its "factory manager" agents. Two months later, the Taiwan attack showed what open-source agents can do in hostile hands5. Just Security argues that Taipei should add agent security to its semiconductor equipment certification scheme, because an agent that holds credentials and can call tools could use legitimate permissions to cause harm faster than humans can step in5.

The defensive advice in the coverage is fairly consistent, and none of it is new. ChannelPro emphasizes identity controls, continuous exposure management and automated detection, and notes that the attackers needed no zero-days9. Titania's Ian Robinson argues that no single credential should unlock the whole network, and that the guardrail bypass shows an agent's built-in safeguards can't be relied on13. Network-telemetry vendors point out that every phase of the attack generated traffic that flow data could reveal6. Segmentation vendors argue that containment matters more as agents speed up the path from first access to valuable data8. These pitches come from companies with products to sell, but they agree on the main point: the weaknesses exploited in Taiwan were basic hygiene failures that machine-speed attackers find quickly.

Is this the future of cyberwarfare?

In part, yes. It is less a new kind of weapon than a sharp drop in what a competent attack costs. Taiwan already faced an average of 2.63 million Chinese cyberattack attempts a day in 2025, up 6% from the year before12. Agents increase the pressure, not the type of threat. Separately, TeamT5 has reported that Chinese state-affiliated groups more than doubled their attack volume after handing off work to DeepSeek and other open models7. South Korean officials now say AI lets attackers hack easily even without specialist skills2.

The warning sign is where the agents went. They moved from personnel records toward a nuclear regulator and energy companies3. Nothing reported shows the agents disrupting anything, but Forbes notes that the same kind of agent could do far more depending on what it can reach1. Becker's advice, that every government should assume it is under permanent automated attack, applies just as much to companies running the same open-source agent frameworks1819.