Near-autonomous AI agent campaign breaches Taiwan government systems

On 12 August 2026, the Financial Times revealed that Taiwanese government systems had been hit in July 2026 by one of the first known hacking operations run largely by AI agents. The campaign was uncovered by Israeli cybersecurity firm Dream, which found a 160 MB online archive of 1,395 files documenting the operation, and Taiwan's Ministry of Digital Affairs confirmed that the island had suffered an AI-assisted attack.

According to Dream, over the first four days of July the agents compromised at least 85 government user accounts and extracted more than 2,500 personnel records (2,564 by The Register's count). They harvested employee usernames from an unauthenticated API, broke into a department's office automation portal while solving its CAPTCHAs, and then moved on to Taiwan's nuclear safety agency, the government email system, IT supply-chain vendors and at least seven energy companies.

How the operation worked

The framework, built on open-source agent tools including OpenClaw and Hermes, ran up to eight sub-agents in parallel across 12 attack waves, each assigned its own targets and techniques. The agents mapped 21 government systems, discovered dozens of API endpoints (many without authentication), changed tactics when blocked, and stole seven SSO client secrets and internal database credentials for MSSQL, Oracle and Sybase systems.

Attribution and response

Taiwan did not publicly name a culprit. Dream noted that the operation's internal documentation was written in simplified Chinese, pointing to a Chinese-language operator. The Administration for Cyber Security said the source, methods and scope of the attacks had been determined and that affected agencies had completed their responses.

Why it matters

The campaign is an early real-world example of a state-scale intrusion where AI agents did much of the reconnaissance, exploitation and adaptation that would normally require a team of operators. It made attacks faster and cheaper while exploiting ordinary weaknesses such as exposed, unauthenticated APIs, which suggests defenders will face more parallel, persistent probing of the same basic gaps.