Taiwan confirms ‘abnormal’ AI-assisted cyberattack on government systems

Taiwan has confirmed that government agencies were targeted by an overseas cyber campaign combining human operators with artificial intelligence agents, following reports of a potentially unprecedented intrusion into public sector and critical infrastructure systems.

The Ministry of Digital Affairs said its cybersecurity monitoring units detected an “abnormal attack” targeting government agencies in July. From 20 July, the National Institute of Cyber Security issued a series of warnings while authorities investigated the source, methods and potential impact of the activity.

Taiwanese officials said the campaign showed clear signs of originating overseas and used a hybrid operating model in which conventional human-directed hacking was supported by AI agents, including the open-source OpenClaw framework.

The ministry said the affected organisations had completed their responses to the incident. It has since introduced protective guidelines and increased monitoring across government systems in an attempt to identify and block similar attacks earlier.

The confirmation came one day after Israeli cybersecurity company Dream published research into a multi-agent hacking framework that it said had successfully compromised government entities in Asia.

The company’s findings, first reported by the Financial Times, identified Taiwan as the apparent target of the operation. Dream itself initially avoided publicly naming the affected government, although its technical report included references to systems associated with Taiwanese agencies.

According to the company, its researchers recovered a 160 megabyte archive containing 1,395 files produced during approximately four days of malicious activity in early July. The archive reportedly exposed the working environment used by the attackers, including operational reports, attack plans and the output generated by multiple AI agents.

Dream said the framework deployed as many as eight agents simultaneously, allowing the system to examine different targets and attack methods in parallel. It was built around two publicly available agent frameworks, Hermes and OpenClaw, although researchers could not determine which underlying AI model powered the operation.

The agents allegedly mapped 21 connected government systems, searched for weaknesses, tested credentials and changed tactics when an attempted route was blocked.

Unlike simpler malicious uses of generative AI, such as producing phishing emails or writing fragments of malware, the system appeared capable of coordinating a longer intrusion campaign. It ranked possible attack paths, assigned work to different agents and used the results of one stage to determine what should happen next.

Researchers said the framework also conducted its own online research when an approach failed, searching vulnerability databases, software repositories and technical publications for alternative techniques relevant to the targeted environment.

The operation compromised at least 85 government user accounts and extracted more than 2,500 personnel records, according to Dream. The stolen information reportedly included employee names, departments, account identifiers and other internal data.

The attackers also obtained information about databases, internal network structures and authentication systems. The operation later expanded towards government technology suppliers, a nuclear safety agency, a government email service and at least seven energy companies.

Some of the initial access reportedly came from familiar weaknesses rather than sophisticated undisclosed vulnerabilities. These included exposed programming interfaces, poorly protected development functions, predictable passwords and trust relationships between connected single sign-on systems.

That combination is significant because it shows how AI agents may amplify weaknesses that defenders already understand but have not corrected. The technology does not necessarily need to discover an extraordinary new vulnerability. It can instead search for ordinary security failures at greater speed, test them repeatedly and pursue several possible entry points at once.

Dream described the operation as near-autonomous, but cybersecurity specialists have cautioned against presenting the incident as an attack independently conceived and executed by artificial intelligence.

A human operator would still have needed to select the target, establish the objective, configure the tools and direct the broader campaign. The agents may have performed much of the reconnaissance and exploitation work, but the available evidence does not suggest that an AI system independently decided to attack Taiwan.

Questions also remain about the identity of the operators.

Taiwan’s official statement did not accuse China or name any particular state-backed group. Dream did not formally attribute the campaign to a known threat actor, although it said internal operational documents used Simplified Chinese while information taken from Taiwanese systems appeared in Traditional Chinese.

The company said the language patterns pointed towards a Chinese-speaking operator. The Financial Times reported that suspected China-linked hackers were believed to be responsible, but the linguistic evidence alone does not prove that the campaign was conducted or authorised by the Chinese government.

Chinese authorities did not immediately respond publicly to the latest allegations.

Taiwan has repeatedly accused Beijing of conducting hybrid operations combining military pressure, disinformation, political interference and cyberattacks. China considers the democratically governed island part of its territory and has continued to increase military activity in the surrounding region.

Taiwan’s National Security Bureau reported that cyberattacks against important infrastructure increased by 6 per cent during 2025, reaching an average of approximately 2.63 million attempts each day. Officials said some incidents were timed to coincide with Chinese military exercises, raising concerns that cyber operations could be used alongside physical pressure during a future crisis.

The latest campaign highlights a growing difficulty for defenders. Traditional cyber operations are often limited by the number of skilled people available to research targets, examine results and adjust attack plans. AI agents can potentially automate parts of that work, allowing one operator to investigate numerous systems simultaneously.

They can also maintain detailed records, retry failed approaches and continue operating without the fatigue or time constraints affecting human teams.

However, the Taiwan incident does not demonstrate that AI agents are infallible. Dream’s report indicated that the framework generated false positives and sometimes misinterpreted technical results. What made the operation more capable was its ability to retest findings, discard some errors and concentrate resources on attack paths it considered more likely to succeed.

The broader danger is therefore not an all-powerful autonomous hacker. It is the growing ability of capable operators to use inexpensive and publicly available AI tools to perform more work, target more systems and adapt more quickly than many government security teams can respond.

Taiwan says the sources, techniques and impact of the July activity have now been investigated and addressed. Its decision to strengthen monitoring and issue new defensive guidance suggests authorities expect the methods to be repeated.

Whether the incident ultimately qualifies as the first fully autonomous cyberattack remains open to debate. What appears clearer is that AI agents have moved beyond assisting with isolated hacking tasks and are beginning to coordinate substantial parts of real-world intrusion campaigns.

For governments and critical infrastructure operators, the warning is immediate. Cybersecurity systems designed to withstand human-speed attacks may increasingly be tested by machines capable of searching, adapting and acting across numerous targets at once.