An Israeli cybersecurity firm, Dream, has documented what appears to be the first fully autonomous, end-to-end AI hacking operation against a government target, reportedly linked to China and aimed at Taiwan. The attack, which occurred over four days in early July, utilized eight AI agents to breach a government network, exfiltrate data, and compromise accounts with minimal human intervention.
The sophisticated operation involved a tool built entirely from publicly available AI agents. This tool autonomously mapped 21 government systems, identified vulnerabilities, and adapted its tactics when encountering obstacles. By the time researchers discovered the activity, the operation had compromised at least 85 government accounts, stolen over 2,500 personnel records, and expanded its reach to include a nuclear safety agency and at least seven energy companies.
Dream's chief strategy officer, Amir Becker, a veteran of Israel's Unit 8200, stated that he had not previously witnessed this level of autonomous capability directed at a government. He emphasized that governments globally should now operate under the assumption of permanent compromise.
While Dream did not officially name the target government, citing company policy, a source familiar with the matter indicated it was Taiwan. Supporting this, internal communications associated with the hacking tool were in Simplified Chinese, while the stolen data was in Traditional Chinese, a script primarily used by government systems in Taiwan, Hong Kong, and Macau. Taiwan's Ministry of Digital Affairs declined to confirm specific details, only stating that incidents involving government agencies are handled according to established procedures.
Unlike AI models "going rogue" in controlled lab environments, this incident involved a deliberately assembled weapon. Researchers found the toolkit as a 160MB archive containing 1,395 files, built around two open-source AI agent frameworks, Hermes and OpenClaw. These frameworks are freely downloadable and designed to enable AI models to perform autonomous tasks in real-world scenarios.
The attackers bypassed the AI model's safety guardrails by framing the entire hacking campaign as an authorized penetration test. The model apparently lacked a reliable mechanism to verify or reject this deceptive premise.
A particularly striking aspect of the attack was the tool's decision-making process. It continuously ranked and reprioritized potential attack paths based on new evidence. When one route failed, it deployed another agent to search the internet for fresh information and devise a different approach, mimicking the iterative process of a human red-teamer, but without the need for human rest.
This development raises concerns for Taiwan, which already experiences an average of 2.6 million Chinese cyberattacks daily, a 6% increase year-over-year in 2025. The introduction of such autonomous capabilities could significantly complicate defense strategies.
