Hackers recently deployed an AI system to carry out sophisticated cyberattacks in Taiwan, officials said. Experts believe is the first known fully autonomous attack on government agencies.
Over four days in July, the AI agents were able to map 21 government systems, crack 85 government user accounts, and extract 2,500 personnel records, according to reports. Experts suspect, but cannot confirm the hackers are from China.
“The investigation found clear indications that the attacks originated overseas and involved a hybrid approach in which hackers combined conventional operations with AI agents such as OpenClaw,” Taiwan’s Ministry of Digital Affairs said in a statement this morning.
Reports indicate that the hackers’ system was built using open-source AI agents to automate and coordinate much of the intrusion, including reconnaissance, credential attacks and strategizing subsequent attack paths. The attack comes amid an increasing number of reports of advanced AI models engaging in unauthorized actions.
The following industry experts weighed in on the situation.
Matt Hartman, Chief Strategy Officer at Merlin Group
"This is certainly a preview of where cyber conflict is headed; however, the important detail isn’t the autonomy, it’s the economics. The operators used publicly available agent frameworks rather than bespoke nation-state tooling, and reportedly bypassed safeguards by presenting the activity as authorized penetration testing.
"That capability won’t stay in state hands. AI compresses reconnaissance from days of work into minutes, which means private sector organizations should expect adversaries to find and exploit weaknesses faster than human teams can triage them. The defender’s imperative now is to fight automation with automation, using AI-driven detection, strong identity controls, and automated response capabilities to contain attacks before they can compound.
Trey Ford, Chief Strategy and Trust Officer at Bugcrowd
"This is not the first AI-driven government attack. It's the first one we've heard about.
"The unit cost of running a capable intrusion has fallen off a cliff because AI has closed the skills gap, using open-source and free tooling, while the cost of defending an enterprise hasn't moved at all. That asymmetry, not the novelty of AI, is the number CISOs and boards need to sit with.
"An AI agent can map 21 systems and crack 85 accounts in four days because it never stops working and never runs out of ideas when one path fails. This is the power of AI driving these attacks at machine speed. What it can't do is know which of your 21 systems actually matters to the business or spot the one weird misconfiguration a seasoned researcher would flag on sight.
"Defenders now need that same combination: machine speed paired with irreplaceable human depth, or they're bringing a knife to a gunfight.
Morey Haber, Chief Security Advisor at BeyondTrust
"The inflection point is AI autonomy. If the reporting is accurate, we are seeing AI agents transition from assisting threat actors to actively participating in the attack lifecycle with decreasing human intervention and increasing success. That alone changes the economics of cybercrime.
"Traditionally, sophisticated attacks required skilled operators to perform reconnaissance, compromise identities, evaluate results, pivot between systems, and determine the next attack path. Agentic AI can potentially perform many of these activities simultaneously, continuously, at machine speed, and all the nefarious best practices to prevent detection. A threat actor no longer needs highly skilled operators to successfully penetrate an organization.
"For the private sector, this means organizations should expect cyberattacks to become faster, more persistent, and significantly more intrusive. Most importantly, autonomous agents will not necessarily follow predefined incident playbooks. They can assess what they discover and dynamically select other paths to privileged access to obtain their objective.
"Organizations therefore cannot fight machine-speed attacks exclusively with human-speed processes. Information security teams need automated detection, continuous identity monitoring, least privilege, just-in-time access, rapid credential revocation, and automated containment all backed by defensive AI to mitigate the risk.
"This cyberattack may resemble the future of cyberwarfare, but it is equally likely to become the future of everyday cybercrime. Once autonomous attack techniques become repeatable, they will inevitably become commoditized and commercially available to threat actors just like ransomware and malware via cybercrime syndicates and darkweb stores.
Diana Kelley, CISO at Noma Security
"Private companies shouldn’t view this solely as a government or military problem. In this incident, the reported activity expanded beyond government systems to suppliers and energy-sector organizations. Cyberattacks can cross the boundary between public and private infrastructure, and agentic AI can make that happen faster.
"Something that can get lost in the headlines, but bears highlighting, is that, as with previously reported AI-enabled attacks, the agents didn’t rely on novel exploits. They leveraged known vulnerabilities and configuration issues such as exposed APIs, weak credentials, authentication flaws, and debug functionality left in production. Even when AI finds a zero-day, the publicly documented examples so far are still instances of known vulnerability classes.
"That means defenders are capable of finding and fixing many of these exposures before an AI agent exploits them. AI agents make basic security failures easier to discover and exploit at scale, but strong identity controls, attack-path analysis, and eliminating exposed services and credentials can stop them from succeeding."
Ram Varadarajan, CEO at Acalvio
"Taiwan wasn’t breached by a smarter hacker, but by a system that could keep probing without getting tired. That’s the shift the private sector needs to start budgeting for. The future is bot-on-bot."
Collin Hogue-Spears, Sr. Director of Solution Management at Black Duck
"There are three key areas to focus on here: Whether the AI wrote the malware; Did something else; and whether the campaign follows a describable pattern.
"The agents ran the intrusion end to end and invented nothing new to run it with. Familiar identity and API failures opened every confirmed path into Taiwan's systems. Dream Research Labs documented up to eight subagents working concurrently across twelve waves, ranking attack paths, redirecting when a technique failed, and researching alternatives online before trying again.
"What they found was exposed development endpoints, an API accepting authentication tokens with the signature check disabled, unauthenticated data APIs, and passwords built from employee ID numbers. The framework also ran its own AI static analysis hunting unknown flaws, but Dream says it worked against two public single sign-on SDK sample projects, and none of those findings produced a confirmed exploit on the live systems.
"No zero-day appears anywhere in the report, but a nuclear safety regulator does.
"Strategic Takeaway: Security leaders must reject unsigned authentication tokens and prohibit the alg:none setting outright and separately require reauthentication or multi-factor at any single sign-on boundary into a sensitive system. Dream describes two independent identity failures in Taiwan, and closing one leaves the other open. Provider guardrails cannot compensate for a password-only SSO bridge."
"In conventional web and identity logs, this reads as a security scan. The distinguishing signal is the sequence across systems, not any single request. The tell is not the request. It is what the same account does next, somewhere else.
"Conventional scanners have tested thousands of endpoints at machine speed for twenty years, so raw coverage is not the change here. What Dream Research Labs describes is chaining: password spraying, then fresh SSO sessions, then access to routes an account had never touched, then the same suspected weakness retested until it held, then one identity surfacing across several connected applications.
"Strategic Takeaway: Security leaders must monitor route diversity per source, per session, per account, and per device rather than by request rate alone, because a distributed set of agents spreads requests across addresses and sessions that no single volume threshold catches. If your detection assumes one attacker at one address working one path at a time, you have modeled the wrong shape. Your thresholds were built for one attacker on one path. This was eight, in parallel.
"Dream rested its China assessment on a code-switching observation, and only half of it points at the attacker. Per Chinese-language coverage of the report, Simplified characters appeared in the operators' internal communications and traditional characters appeared in the exfiltrated data. The first describes the operator's working language. The second describes the victim, because that is what Taiwanese government files look like [traditional characters].
"The evidence therefore supports a Chinese Mainland-language operator against a Taiwanese target, with a target profile consistent with mainland collection priorities. It does not name a group or establish state direction. The report also publishes no indicators, no hashes, and no victim confirmation; it does not identify the model, and its executive summary claims installed backdoors while its own attack chain says authentication blocked the web shell.
"Strategic Takeaway: Security leaders must ask two questions of any AI attack disclosure before acting on it: Which model ran the operation, and what can we hunt on tomorrow morning?"
Agnidipta Sarkar, Chief Evangelist at ColorTokens
"The attack went from Reconnaissance & Scraping to Initial Access by exploiting exposed developer debug backdoors. It then went to Lateral Movement & Persistence by using cracked credentials to pivot through SSO bridge endpoints into internal systems without triggering additional MFA, at an extremely rapid pace.
"It is fascinating how the system did not use traditional linear brute-forcing. It scored individual vulnerabilities using Bayesian posterior probabilities and dynamically calculated multi-step attack-path success probabilities. The framework then ran real-time 'Learning Cycles', automatically scraping vulnerability databases, GitHub repositories, and vendor documentation to research exploits tailored specifically to the target's environment.
"It then eliminated false positives by cross-verifying with three independent agents twice, a technique I wish we had in AI-powered SIEM or other intelligence tools in the SOC.
"In my view, EDR-integrated microsegmentation could have made a significant difference between the incident and the chaos. Had zones and microsegments isolating the OA network from core databases and internal administrative interfaces, regardless of SSO trust, been created as part of the design, AI agents authenticating to the Office Automation (OA) portal would not have gained trusted access to internal dashboards and equipment management systems.
"Unauthenticated internal endpoints (such as the exposed personnel database) would be ring-fenced, allowing access only from authenticated, explicitly allowed app tiers rather than any node inside the network. Restricting inter-workload traffic would have blocked internal API endpoints and developer debug backdoors from being accessible outside their immediate service container."
Aviv Nahum, Co-founder and CEO at Above Security
"Once an agent is operating inside your environment with valid access, the question can no longer just be whether it was authorized to perform an action. You need to understand whether the behavior itself makes sense: why it accessed that system, why it touched that data, what it did before and after, and whether the overall sequence is consistent with its intended role.
"The same is true whether the agent is one your company deployed or one an attacker is using against you.
"The bigger shift in cyber defense is therefore from protecting identities to continuously understanding them. Attackers can now automate reconnaissance, learn from failed attempts, and pursue multiple paths in parallel. Defenders cannot answer that with another static rule.
"The organizations that are prepared for this world will be the ones that can continuously investigate the behavior of both humans and agents and intervene when legitimate access turns into risky behavior."
