AI agents breached Taiwan's government in four days
Open-source AI agents compromised 85 accounts and stole 2,500 personnel records from Taiwan's government in four days. Our read on what changes now.
A multi-agent AI system breached Taiwan’s government over four days in July. The models it ran on are free to download.
Israeli security firm Dream published the findings on August 12 after locating a 160 MB archive the operators had left exposed, 1,395 files documenting the operation from the inside. CyberScoop and The Register have both reviewed the material. The system coordinated up to eight sub-agents across 12 attack waves, built on the open-source Hermes models and the OpenClaw agent framework. It compromised 85 government accounts, extracted over 2,500 personnel records and mapped 21 connected government systems. Targets included Taiwan’s nuclear safety agency, a government email system, IT suppliers and at least seven energy companies. Dream describes a Chinese-language operator and stops short of naming a group.
Two things in that archive matter more than the headline.
First, the guardrails. The operators got the models to cooperate by framing the whole operation as authorized penetration testing. When Anthropic’s own tests breached three real companies in July, the vendor could still revoke access and patch the behavior. Here the weights ran on attacker hardware. There was no account to suspend and no API to rate-limit. Our report on AI-driven hacking argued two days before this story broke that open models set the capability floor for attackers. This operation shows where that floor already sits.
Second, the tempo. Per Dream’s analysis, the agents ran learning cycles, searched vulnerability databases and GitHub for working techniques, solved CAPTCHAs and retried their own failed attempts. Human intrusion crews pause. They sleep, they hand over between shifts. An agent swarm probes in parallel and comes back in seconds. In the Falcon console I look at dwell times and beacon intervals that assume a human on the other end. This operation is the argument for retiring that assumption.
Still, nothing in the entry path was new. Password spraying opened the accounts. Exposed API endpoints gave the agents their map, 36 of them on a single target. The AI did not invent a technique. It made old techniques cheap and parallel.
What you do about it: enforce MFA and alert on spray patterns, because machine-tempo password guessing lights up failed-login telemetry the moment someone watches for it. Get an inventory of your internet-facing API endpoints, the agents mapped 21 systems because the map was there to make. And test whether your detections fire on parallel, scripted behavior rather than only on human playbooks. We treat all three as core AI security work.
Talk to me if you want our read on what agentic attackers mean for your detections.
Drafted with AI assistance, reviewed and edited by Kenny Le and the FM CyberSecurity editorial team.
Sources
- CyberScoop, “Researchers observe first ‘near-autonomous’ AI attack on government target in Taiwan,” August 12, 2026
- The Register, “‘Near-autonomous’ AI agents attack Taiwan’s nuclear safety agency,” August 12, 2026
- CNN Business, “Hackers used autonomous AI agents to attack Taiwan. Is this the future of cyberwarfare?,” August 13, 2026