Autonomous AI Agents Breach Taiwan Government Systems in First Known Real‑World Attack

Taiwan’s government has confirmed what researchers say may be the first documented case of a fully autonomous AI‑driven cyberattack against a national infrastructure. The Ministry of Digital Affairs said its monitoring units detected anomalous activity in July and began issuing advisories on July 20, triggering an immediate investigation. Officials now say the affected agencies have completed their response, but the incident has forced a reassessment of how quickly AI‑enabled intrusions are evolving.

The attack was traced to foreign operators and involved a hybrid model that combined conventional hacking techniques with autonomous AI agents capable of planning, executing, and adapting their own operations. According to Dream, the Israeli security firm that analyzed the breach, the attackers used a multi‑agent framework built on open‑source platforms Hermes and OpenClaw. The system ran up to eight sub‑agents in parallel during each wave of activity, with each agent assigned to a distinct target or technique. Over roughly four days in early July, the framework mapped 21 connected government systems, cracked 85 employee accounts, and exfiltrated more than 2,500 personnel records, along with internal database credentials and SSO client secrets.

Dream’s researchers say they recovered the attackers’ entire operational workspace—a 160‑megabyte archive containing about 1,400 files—while investigating the intrusion. The archive revealed a campaign that looked less like a human red‑team exercise and more like a machine‑speed operation capable of chaining together reconnaissance, exploitation, lateral movement, and exfiltration without waiting for human direction. MODA described the attack as clearly originating overseas, and while neither Taiwan nor Dream has formally attributed it, experts suspect a China‑based operator. Dream noted that internal documentation alternated between Simplified Chinese and Traditional Chinese, a detail they consider a soft attribution signal.

The attack chain began with automated reconnaissance. The framework decompiled JavaScript bundles from a government web portal to extract every embedded API endpoint, OAuth client ID, and Keycloak configuration. From that single entry point, it mapped Taiwan’s national single sign‑on architecture, including six sub‑realms, signing keys, and every supported authentication flow. It then scraped a public documentation site for the SSO system, pulled down sample integration code, and ran AI‑driven static analysis to identify potential flaws.

Initial access came from multiple angles. The system discovered undocumented debug endpoints that returned authenticated sessions to any request. It also launched automated credential‑spraying attacks against an employee portal, solving CAPTCHAs and cracking 85 accounts by testing predictable password patterns tied to employee IDs. In another case, it identified an API that accepted forged JSON Web Tokens because the signature‑checking algorithm was set to “none,” allowing the agents to mint their own valid tokens.

Once inside, the framework tested each cracked account against every internal system trusted through the SSO bridge. Eighty‑four of the 85 accounts—98.8 percent—pivoted into internal systems without requiring additional authentication. With that access, the agents pulled personnel records, full user‑database exports, internal network details, and credential information. Rather than stopping at government systems, the framework expanded its scope to scan IT supply‑chain vendors, a nuclear safety agency, a government email system, and multiple energy‑sector companies for similar exposures.

Dream’s report argues that the most consequential part of the incident is not the stolen data but the system’s decision‑making architecture. Instead of brute‑forcing every possible vulnerability, the framework used a two‑layer Bayesian scoring model to evaluate both individual findings and entire multi‑step attack chains. It calculated a 99 percent probability of success before running its most effective chain—pivoting from a cracked SSO account into internal systems—and was validated when 98.8 percent of accounts succeeded. The system also ran autonomous “Learning Cycles,” searching vulnerability databases, GitHub repositories, and security publications for techniques relevant to Taiwan’s technology stack, then feeding those results into subsequent waves of attacks.

Perhaps most striking is that the framework caught its own mistakes. Dream found that the system flagged and discarded seven false positives during the campaign, including a suspected SQL injection that its own agents later determined was simply an email‑server timeout. Findings were only accepted after surviving six rounds of independent verification. When the underlying models initially refused to execute certain attack steps, the operators reportedly bypassed those guardrails by framing the operation as authorized penetration testing.

Security experts say the incident marks a turning point. Trey Ford of Bugcrowd noted that the unit cost of running a capable intrusion has collapsed because AI has closed the skills gap, while the cost of defending an enterprise has not moved. An AI agent can map 21 systems and crack 85 accounts in four days because it never stops working and never runs out of ideas. What it cannot do, Ford said, is understand which systems matter most to the business or spot the subtle misconfigurations a seasoned researcher would catch instantly. Defenders now need machine‑speed automation paired with human depth or risk being outmatched.

Industry experts warn that the implications extend far beyond Taiwan. Multi‑agent frameworks built entirely on free open‑source models can now run reconnaissance, credential attacks, and lateral movement in parallel, continuously reprioritizing targets based on live evidence. The vulnerabilities exploited in this attack—unauthenticated APIs, debug endpoints left in production, predictable passwords, JWTs accepting “none,” and SSO trust relationships without secondary authentication—are not novel. They are long‑standing issues that AI can now discover and chain together at a scale that turns moderate misconfigurations into serious breaches.

Taiwan’s response included new AI‑specific threat guidance, expanded cross‑agency intelligence sharing, and strengthened monitoring across ministries. Officials say they will continue to track emerging attack paths and reinforce national defenses based on lessons learned from the incident. The broader concern is that autonomous attack techniques, once proven effective, will become repeatable and eventually commoditized, making AI‑driven intrusions a routine part of both cybercrime and cyberwarfare.