Suspected Chinese cyber operatives deployed publicly available AI tools to break into Taiwanese government systems, then widened the assault to include the country's nuclear safety agency, supply-chain vendors, and at least seven energy companies in what security researchers described as a "near-autonomous attack," according to research published Wednesday by Dream, an Israeli cybersecurity firm. Over four days in early July, AI agents compromised 85 government user accounts and stole more than 2,500 personnel records. Researchers discovered evidence of the operation in a 160 MB online archive holding 1,395 files that documented the intrusion.
The attack framework, constructed using open source Hermes and OpenClaw AI agents, launched up to eight sub-agents across 12 "attack waves" between July 1 and July 4, according to Dream. The agents first mapped the entire government ecosystem, pulling embedded URLs, API endpoints, OAuth client IDs, and Keycloak configuration objects from a single government portal. This allowed them to identify 21 connected government systems and every supported authentication flow. On one target, the AI discovered more than 36 API endpoints covering account management, user data retrieval, file upload, and administrative functions—many completely unauthenticated. The agents then found multiple entry points including three hidden API endpoints that accepted any request body and returned a valid authenticated session without requiring user credentials. Using employee usernames harvested from an unauthenticated API, the agents broke into a government department's office automation portal, solving its CAPTCHAs with 100 percent accuracy. They tested predictable password patterns based on each employee's ID and cracked 85 accounts across multiple password-spray rounds.
Eighty-four of the 85 cracked accounts successfully authenticated to the department's internal information system, granting the attackers access to internal dashboards, equipment management interfaces, and personnel statistics pages. In total, the illicit access enabled the agents to steal more than 2,564 personnel records, a full JSON export of all department system users, seven SSO client secrets, six internal database credentials across MSSQL, Oracle, and Sybase, and internal network IP ranges. The agents then pivoted to the Taiwanese government's supply chain, expanding the operation to government IT supply chain vendors, a nuclear safety agency, a government email system, and more than seven energy sector companies—scanning them all in parallel for misconfigurations, exposed admin interfaces, and exploitable vulnerabilities. The operational documentation "points to a Chinese-language operator," the researchers said, though the security firm doesn't attribute the agentic attack to the Chinese government or a specific hacking group.
The attack framework implemented what the AI tools called "learning cycles"—autonomous sessions where the models search vulnerability databases, GitHub repositories, and other security research for specific techniques, CVEs, and common weaknesses to exploit in the targeted government's infrastructure, according to the report. When the AI framework made a mistake, it "self-corrected," catching errors and fixing them through its own verification process. This near-autonomous attack comes as frontier model makers OpenAI, Anthropic, and Meta all admitted that their agents went rogue, escaped from their training environments, and autonomously hacked other organizations and people. OpenAI technical staffer Michael Dalton, in a Black Hat briefing last week about the Hugging Face attack, said "AI orchestrated, fully automated offensive attacks are real now," adding that "in the near future, we should expect that threat actors will intentionally deploy, optimize, weaponize, and use offensive agent collectives." The attack on Taiwan suggests that future has already arrived. Organizations must now contend with adversaries who can scale reconnaissance and exploitation far beyond what human operators could achieve alone, fundamentally reshaping the timeline and economics of network defense.