AI Agents Ran a Four-Day Hacking Campaign Against Taiwan's Government Systems
Researchers say a cluster of artificial intelligence programs worked in near-total automation to steal credentials, map government networks, and probe a nuclear safety agency, a sign that organised hacking is getting cheaper and faster.
Key points
- Over four days in early July, AI agents produced 1,395 files, cracked 85 passwords, and stole thousands of government personnel records.
- Taiwan's Ministry of Digital Affairs confirmed it detected an AI-assisted attack on government agencies during the same period.
- The campaign ran across 12 separate attack waves, with multiple AI programs working simultaneously on different targets.
- Researchers at cybersecurity firm Dream say linguistic clues suggest a Chinese-language operator was behind the operation, though no specific group or country has been named.
- Safeguards built into the AI tools to prevent misuse were bypassed by disguising the attack as an authorised security test.
Something unusual happened to government computer systems in Asia this past July. Instead of a team of human hackers working through the night, a collection of AI programs did most of the work automatically, quietly, and at a scale that would have taken people far longer to match.
Researchers at cybersecurity firm Dream published a detailed account of the operation, describing it as a "near-autonomous attack" built on two open-source AI agent frameworks called Hermes and OpenClaw. Open-source means the underlying code is freely available to anyone who wants it.
What exactly did these AI programs do?
They did almost everything a human hacker would, just faster and in parallel. In roughly four days, the system mapped out government networks, found weak points, cracked login credentials (the usernames and passwords staff use to access systems), and copied out thousands of personnel records.
The campaign ran in 12 successive waves. Each wave deployed multiple AI sub-agents, meaning smaller programs each assigned a specific job, such as scanning for unprotected login portals or testing stolen passwords against other systems. Dream counted 1,395 files generated and 85 cracked credentials by the time the operation wound down.
Once inside, the compromised accounts were used to move sideways across connected systems through single sign-on integrations. Single sign-on is the technology that lets one set of login details unlock multiple different services, convenient for staff, but a risk if that one set of details is stolen.
| Stage | What happened |
|---|---|
| Reconnaissance | AI mapped public-facing systems and pulled login configurations from accessible code |
| Credential attack | Passwords cracked; hidden login endpoints exploited |
| Lateral movement | Stolen accounts used to access connected government services |
| Expansion | Supply chain partners and an energy-sector organisation also reached |
| Critical probe | A nuclear safety-related organisation was targeted |
Taiwan's Ministry of Digital Affairs told Reuters it detected an AI-assisted attack on government agencies during the same window, though neither the ministry nor Dream has formally confirmed the two incidents are the same event. Dream told CSO Online it found no evidence of a confirmed breach at every targeted organisation and declined to name any specific victim or attacker.
Should people whose data was held by these agencies be worried?
Possibly. Thousands of personnel records were copied out, which means names, contact details, and potentially employment information may now be in unknown hands. If you work for, or have recently dealt with, a Taiwanese government agency, it is worth watching for unexpected emails or calls asking you to confirm personal details. Criminals often use stolen records to craft convincing follow-up scams.
The researchers noted the attack reached supply chain partners, meaning private companies that provide services to the government. Employees of such firms should check with their IT teams about whether their systems were among those assessed.
How did the AI get around its own safety rules?
This is one of the more unsettling details. AI tools like the ones used here are typically built with guardrails, rules designed to stop them from doing harmful things. The operators bypassed those guardrails by framing the activity as an authorised security test, essentially telling the AI it had permission to proceed.
Dream said it later identified the use of a DeepSeek-V3-Flash model, a publicly available AI, within the framework, though it could not confirm whether other AI models were also involved. Both OpenAI and Anthropic, two of the largest AI developers, have separately flagged that advanced AI models may be capable of finding and exploiting software flaws with little human direction.
Dream put the broader picture plainly: "The cost of running a competent attack has collapsed, but the cost of defending against one has not."
