In what is being called the first cyber attack of its type, autonomous AI agents were used to map a score of Taiwan government systems and crack 85 accounts. While there has been no formal attribution as of yet, evidence points strongly to an overseas origin and likely to hackers based in China.
The system managed eight autonomous AI agents on its own as it made independent decisions about what to target and what techniques to use. This included responding to new defensive measures in real time by adapting its approach. Taiwan was already fielding some 2.6 million cyber attacks per day on average originating from China, and is likely looking at substantially more if this becomes regular practice by Chinese spies.
Autonomous AI system independently cracked many government accounts, exfiltrated private records
Security firm Dream has documented the cyber attack and reports that the AI agents mapped a total of 21 Taiwan government systems, cracked 85 user accounts and exfiltrated about 2,500 personnel records. It is thought to be the first recorded case of a fully automated AI-based cyber attack being successfully executed against a government.
The cyber attack took place over the course of several days in early July, and the victims appear to be Taiwan’s nuclear safety agency and a number of energy sector companies, as well as numerous government IT vendors. Chinese text found in internal documents indicates that the autonomous AI agents were deployed and managed by someone in the country.
The autonomous AI system was built on two popular agent systems: OpenClaw and Hermes. These agents were used to create eight lettered sub-systems used in the cyber attack, each one assigned to distinct attack types and targets. Working in parallel these agents were able to crack numerous government employee passwords, exfiltrate hundreds of personnel records from unauthenticated API endpoints, and install persistent backdoors on government web applications. At least one agent additionally discovered a signature validation flaw in the government’s personal authentication service.
The attackers were apparently able to bypass usual LLM safety guardrails by framing all of the activity as “authorized penetration testing.” The cyber attack was staged in waves with the autonomous AI agents ordered to continuously evaluate and prioritize targets of highest value, and to incorporate what was learned in each wave into planning for the next wave without human intervention. On the subject of automated learning, the agents also entered a “learning cycle” upon encountering a defensive measure that blocked them; this involved searching GitHub, security publications and vulnerability databases for ways to get around the defensive sticking point.
Automated cyber attack reaches speed and scale beyond human capability
As with recent autonomous AI cyber attacks that have made the news, the effectiveness lies not in the agents outperforming human hackers but rather trying every possibility and moving at speeds beyond what a human attacker could match. Frontier agents remain crude and noisy in most of their actions, but nevertheless highly effective due to this. It also demonstrates that the cost of and barriers of entry to effective cyber attacks have been substantially reduced.
In this case, the autonomous AI agents were able to first very rapidly map the entire Taiwan government cyber ecosystem and discover dozens of unauthenticated API endpoints to use as a critical crack in the initial layer of defense. One of these endpoints in particular exposed an entire system that had no authentication in place whatsoever, from which the attacking agents were able to exfiltrate thousands of employee records including names, departments, and SSO account IDs.
The autonomous AI then used the records it uncovered to password spray known usernames. It was able to defeat CAPTCHA checks in this process by using Tesseract OCR, an open-source project sponsored by Google that is backed by neural networks and highly adept at pulling text out of scanned documents. The cyber attack boasted a 100% success rate in beating these CAPTCHA checks. The agents then stuck to “predictable” passwords in spraying the target accounts, but nevertheless came up with 85 hits in total.
The Dream report concludes by warning that the researchers believe governments are by and large not ready for the autonomous AI threat, even though it is now confirmed to be operating in the wild. As they note, the cost of running a competent cyber attack has collapsed but the cost of defense has not. Developer guardrails remain the primary safeguard against attacks of this sort, but as this incident demonstrates they cannot be reliably counted on to hold up.
Matt Hartman, Chief Strategy Officer at Merlin Group, builds on the “cost barrier” element and what smaller organizations that are not normally targeted by advanced nation-state hackers can expect in the near term: “This is certainly a preview of where cyber conflict is headed; however, the important detail isn’t the autonomy, it’s the economics. The operators used publicly available agent frameworks rather than bespoke nation-state tooling, and reportedly bypassed safeguards by presenting the activity as authorized penetration testing. That capability won’t stay in state hands. AI compresses reconnaissance from days of work into minutes, which means private sector organizations should expect adversaries to find and exploit weaknesses faster than human teams can triage them. The defender’s imperative now is to fight automation with automation, using AI-driven detection, strong identity controls, and automated response capabilities to contain attacks before they can compound.”
Trey Ford, Chief Strategy and Trust Officer at Bugcrowd, adds: “The unit cost of running a capable intrusion has fallen off a cliff because AI has closed the skills gap, using open-source and free tooling, while the cost of defending an enterprise hasn’t moved at all. That asymmetry, not the novelty of AI, is the number CISOs and boards need to sit with.”
“An AI agent can map 21 systems and crack 85 accounts in four days because it never stops working and never runs out of ideas when one path fails,” Ford adds. “This is the power of AI driving these attacks at machine speed. What it can’t do is know which of your 21 systems actually matters to the business or spot the one weird misconfiguration a seasoned researcher would flag on sight. Defenders now need that same combination: machine speed paired with irreplaceable human depth, or they’re bringing a knife to a gunfight.”
But Diana Kelley, Chief Information Security Officer at Noma Security, sees at least something of a silver lining in this report: “Something that can get lost in the headlines, but bears highlighting, is that, as with previously reported AI-enabled attacks, the agents didn’t rely on novel exploits. They leveraged known vulnerabilities and configuration issues such as exposed APIs, weak credentials, authentication flaws, and debug functionality left in production. Even when AI finds a zero-day, the publicly documented examples so far are still instances of known vulnerability classes … That means defenders are capable of finding and fixing many of these exposures before an AI agent exploits them. AI agents make basic security failures easier to discover and exploit at scale, but strong identity controls, attack-path analysis, and eliminating exposed services and credentials can stop them from succeeding.”
