AI agents compromised 85 Taiwanese government accounts

Suspected Chinese cyber operatives used publicly available AI tools to compromise 85 Taiwanese government accounts and extract more than 2,500 personnel records between July 1 and July 4, 2026, in an operation researchers described as a “near-autonomous attack.” The Register reports that the campaign later spread to government suppliers, Taiwan’s nuclear safety agency, its government email system, and at least seven energy companies.

The findings come from Israeli cybersecurity firm Dream, which found a 160 MB archive containing 1,395 files documenting the operation. Dream initially said only that “government entities in Asia” had been targeted; a person familiar with the incident confirmed Taiwan to The Register. Dream did not attribute the activity to the Chinese government or a specific hacking group, although its researchers said the documentation pointed to a Chinese-language operator.

The attack framework was built around the open-source Hermes and OpenClaw AI agents. It deployed as many as eight sub-agents, each assigned targets and attack techniques, across 12 attack waves.

How the agents breached the government network

The agents first mapped a government portal and extracted embedded URLs, API endpoints, OAuth client IDs, and Keycloak configuration objects. That exposed 21 connected government systems and their authentication flows. On one system, the researchers found 36 or more API endpoints, including interfaces for account management, data retrieval, file uploads, and administrative functions.

Some of those interfaces were unauthenticated. One exposed an entire user database containing thousands of employee names, departments, and single sign-on account IDs. The agents also identified three hidden API endpoints that accepted arbitrary request bodies and returned valid authenticated sessions without user credentials.

Using usernames collected from the exposed API, the agents entered a government department’s office automation portal. Dream said they solved its CAPTCHAs with 100 percent accuracy, then tested predictable passwords derived from employee IDs and cracked accounts through multiple password-spraying rounds.

Of the 85 compromised accounts, 84 successfully authenticated to the department’s internal information system. The attackers obtained dashboards, equipment-management interfaces, personnel statistics, and:

• 2,564 personnel records
• A full JSON export of department system users
• Seven SSO client secrets
• Six internal database credentials for MSSQL, Oracle, and Sybase
• Internal network IP ranges

The agents then scanned supply-chain vendors, the nuclear safety agency, the government email system, and energy companies in parallel for misconfigurations, exposed administrator interfaces, and exploitable vulnerabilities.

Dream said the framework included “learning cycles,” in which the models searched vulnerability databases, GitHub repositories, and security research for relevant CVEs and attack techniques. It also used an automated verification process to detect and correct some of its own mistakes.

“AI orchestrated, fully automated offensive attacks are real now.”

Dalton made the comment during a Black Hat briefing about the Hugging Face attack. He also warned that threat actors would deploy and optimize offensive agent collectives. The Taiwan operation suggests that this capability is no longer limited to controlled demonstrations.

The incident gives concrete weight to the enterprise risks behind security tools for autonomous AI agents, particularly around permissions, tools, memory, and actions inside corporate systems. Dream’s report does not establish how much of the operation was directed by a human, but its agents handled reconnaissance, credential attacks, vulnerability research, lateral expansion, and error correction with limited intervention described in the available findings.