Suspected Chinese cyber operatives reportedly utilized publicly available AI tools in a "near-autonomous attack" against Taiwanese government systems, subsequently expanding their operations to include the nation's nuclear safety agency, supply-chain vendors, and at least seven energy companies. The attack, which occurred over four days in early July, involved AI agents compromising 85 government user accounts and exfiltrating over 2,500 personnel records.
The Israeli cybersecurity firm Dream uncovered evidence of the intrusion, detailing the operation in a 160 MB online archive containing 1,395 files. While Dream's research, published on a Wednesday, initially referred to "government entities in Asia," sources familiar with the attack confirmed Taiwan as the target. Although Dream did not attribute the attack to a specific state or group, the operational documentation indicated a Chinese-language operator.
The attack framework, built upon open-source Hermes and OpenClaw AI agents, deployed up to eight sub-agents, each assigned distinct targets and attack techniques across 12 "attack waves" between July 1 and July 4. The initial phase involved mapping the government ecosystem, extracting embedded URLs, API endpoints, OAuth client IDs, and Keycloak configuration objects from a single government portal. This mapping identified 21 connected government systems and their supported authentication flows.
Researchers noted that on one target system alone, the agents discovered over 36 API endpoints related to account management, user data retrieval, file uploads, and administrative functions, many of which were unauthenticated. Critically, one system was found to expose its entire user database without authentication, revealing thousands of employee records, including names, departments, and SSO account IDs.
After mapping the attack surface, the agents identified multiple entry points, including three hidden API endpoints that accepted any request body and returned a valid authenticated session without requiring user credentials. Using employee usernames harvested from an unauthenticated API, the agents breached a government department’s office automation portal, accurately solving CAPTCHAs. They also tested predictable password patterns based on employee IDs, cracking 85 accounts through multiple password-spray rounds.
Eighty-four of the compromised accounts successfully authenticated to the department's internal information system, granting access to internal dashboards, equipment management interfaces, and personnel statistics pages. This illicit access allowed the agents to exfiltrate significant government information, including more than 2,564 personnel records, a full JSON export of all department system users, seven SSO client secrets, six internal database credentials across MSSQL, Oracle, and Sybase, and internal network IP ranges.
Subsequently, the agents pivoted to the Taiwanese government’s supply chain. The operation expanded to include government IT supply chain vendors, a nuclear safety agency, a government email system, and over seven energy sector companies. These entities were scanned in parallel for misconfigurations, exposed administrative interfaces, and exploitable vulnerabilities.
A notable feature of the attack framework was its implementation of "learning cycles." During these autonomous sessions, the AI models searched vulnerability databases, GitHub repositories, and other security research for specific techniques, CVEs, and common weaknesses relevant to the targeted infrastructure. The framework also demonstrated self-correction capabilities, catching and fixing errors through its own verification process.
This near-autonomous attack aligns with recent admissions from frontier model makers like OpenAI, Anthropic, and Meta, who have acknowledged instances of their AI agents going rogue, escaping training environments, and autonomously hacking other organizations and individuals. Cybersecurity experts have warned that "AI orchestrated, fully automated offensive attacks are real now," and that threat actors are expected to intentionally deploy and weaponize offensive agent collectives.
