Researchers document a near-autonomous AI-agent attack on Taiwan

Israeli cybersecurity firm Dream has documented what it describes as the first government-level cyber intrusion coordinated and executed almost entirely by AI agents: a four-day operation against Taiwanese government systems in early July 2026 that compromised 85 accounts and exfiltrated more than 2,500 personnel records, according to The Register and CyberScoop. The attackers did not write bespoke malware - they wired together two publicly available open-source agent frameworks, Hermes and OpenClaw, which is the part that should concern every developer building with the same class of tools.

CyberScoop, which notes the research was first reported by the Financial Times, calls it the first publicly documented case of an autonomous AI framework targeting government infrastructure. Dream does not attribute the campaign to the Chinese government or a named group, but says the operational documentation "points to a Chinese-language operator."

What the agents actually did

Per The Register, the system deployed up to eight sub-agents in parallel across 12 attack waves between July 1 and July 4, each working a different angle - reconnaissance, credential attacks, and planning the next move - more like a coordinated team than a single script. Dream researchers say that "on one target alone, it discovered 36+ API endpoints spanning account management, user data retrieval, file upload, and administrative functions - many completely unauthenticated."

The effectiveness numbers The Register reports are the uncomfortable part: a 100% CAPTCHA-solving accuracy rate, and successful authentication into 84 of 85 cracked accounts. The operation mapped 21 connected government systems and pivoted outward to a nuclear safety agency, IT supply-chain vendors, and seven or more energy companies.

Why "near-autonomous" is the key word

The distinction the researchers draw is not that a model wrote some exploit code - that is old news - but that the system managed its own strategy. CyberScoop reports the framework could "adapt mid-operation without human intervention," and that it ran dedicated research phases Dream calls "Learning Cycles": "autonomous sessions where the AI system searches vulnerability databases, GitHub repositories, and security research publications for techniques."

Two guardrail-relevant details stand out. First, per Security Affairs, the operators bypassed the underlying models' safety guardrails by framing the whole operation as authorized penetration testing. Second, Dream is candid that this was not turnkey: "building a system that actually works at this level takes more work than 'just' running a model." The barrier is engineering effort, not a missing capability.

What this means for developers

The immediate lesson is defensive and concrete: the attack's highest- yield finding was 36+ largely unauthenticated API endpoints on a single target. An autonomous agent's advantage is tireless enumeration - it will find the forgotten internal endpoint, the un-gated admin route, the API that returns a valid session without checking one. Audit your own surface as if a system that never sleeps and never gets bored is enumerating it, because now one is: require auth on every endpoint by default, rate-limit and monitor for the parallel-scan signature Dream describes, and stop assuming CAPTCHA is a meaningful barrier.

There is also a supply-chain-of-capability point worth naming. The offensive tool here was assembled from open-source agent frameworks - Hermes and OpenClaw - and off-the-shelf models jailbroken with a pen-testing pretext. That is the same stack thousands of developers use to build legitimate agents, which makes this less a story about exotic nation-state tooling and more about what any sufficiently motivated operator can now wire together. Dream's chief strategy officer, Amir Becker, put the takeaway for defenders bluntly: "This must be the basic assumption of every government around the globe" - and, increasingly, of every organization running an internet-facing API.