Taiwan's government has confirmed that a "near-autonomous" cyberattack powered by artificial intelligence agents breached dozens of official accounts and siphoned off thousands of personnel records this summer, in what cybersecurity researchers are calling one of the first known instances of a nation-state weaponizing mainstream AI tools against a government target.

Taiwan's Ministry of Digital Affairs said its cybersecurity monitoring units detected the "abnormal attack" after it began in July, prompting the National Institute of Cyber Security to issue a series of warning alerts while investigators assessed the damage. The ministry said the agencies caught up in the breach have "successively completed the response measures," though it declined to detail the scale of the intrusion or which specific agencies were hit hardest.

That detail came from Dream, an Israeli cybersecurity firm that traced the campaign and published its findings this week. According to Dream's research, the attacker cracked 85 government accounts, mapped 21 connected government systems and extracted more than 2,500 personnel records over the campaign's active run — deploying as many as eight autonomous AI agents working in parallel at any given time.

An Attack That Adapted Itself

What set the campaign apart from ordinary state-linked hacking, researchers say, was how little human hand-holding it required. The attackers built their platform on two open-source AI agent frameworks, Hermes and OpenClaw, wiring them into what Dream described as a "hybrid model" capable of running "Learning Cycles" — autonomous research phases in which the AI agents probed for vulnerabilities, attempted intrusions and adjusted their tactics in real time whenever an attack path failed, without a human operator directing each step.

"THE ATTACKER DIDN'T STOP AT PRIMARY TARGETS. IT EXPANDED THE OPERATION TO GOVERNMENT IT SUPPLY CHAIN VENDORS, A NUCLEAR SAFETY AGENCY, A GOVERNMENT EMAIL SYSTEM, AND 7+ ENERGY SECTOR COMPANIES."

That expansion, described by Dream researchers, took the campaign well beyond its initial targets — reaching into Taiwan's nuclear safety oversight body and at least seven energy companies, all firms whose disruption could ripple into the island's power grid. CyberScoop's reporting on the findings notes that researchers found Simplified Chinese in the attackers' internal communications, pointing toward a likely China connection, though Taiwan's government has stopped short of formally attributing the campaign to Beijing.

The Financial Times first reported Dream's findings on Aug. 12, and outlets including CNN and Taiwan's own Taipei Times have since detailed how the AI-driven approach let a small team run reconnaissance and exploitation simultaneously across dozens of targets — a scale of automation security researchers had warned was coming but had not previously documented in a live government breach.

Beijing has not issued a public response to the specific findings. China has routinely denied similar hacking accusations from Western and Taiwanese officials in the past, typically characterizing them as fabrications meant to justify tighter cybersecurity restrictions on Chinese technology.

For Taiwan, the breach lands amid an already tense summer, with the island in the middle of its largest-ever reservist call-up for annual defense drills and Beijing continuing near-daily military patrols near Taiwanese waters and airspace. Security researchers say the AI-agent campaign is likely to become a template both for future attacks and for the defenses built to counter them, since the same automation that let the attackers scale up can, in theory, be turned toward faster detection and response. Taiwan's Ministry of Digital Affairs has not said whether the personnel data taken in the breach has surfaced anywhere publicly, and the investigation remains open.