Taiwan's Ministry of Digital Affairs confirmed on Aug. 13, 2026 that government agencies sustained an "AI agent-assisted" cyberattack in July, following research from Israeli security firm Dream describing a "near-autonomous" campaign against unnamed "government entities in Asia." Across roughly four days, the operation mapped 21 connected government systems, cracked 85 employee accounts, and extracted personnel records. Figures for the exfiltration vary by source: Dream and most outlets report "more than 2,500" personnel records, while Tenable's Research Special Operations team puts the count at "more than 2,564." Dream declined to name the victim; The Register cited a person familiar with the attack confirming Taiwan, and the Financial Times identified Taiwan first. Notably, neither Dream nor Taiwanese authorities have explicitly confirmed that the Dream research and the Ministry of Digital Affairs incident describe the same event.
What Happened
Dream researchers located a 160 MB internet-exposed archive containing 1,395 files that documented the operation in near-real time. The files record 12 discrete "attack waves" conducted between July 1 and July 4, 2026, driven by a framework built on the open-source Hermes and OpenClaw AI agents. The framework deployed up to eight sub-agents in parallel, each assigned its own targets and techniques, covering reconnaissance, credential attacks, API testing, data collection, and lateral movement.
The Register reports the campaign did not stop at core government systems: it expanded to Taiwan's nuclear safety agency, supply-chain vendors, and at least seven energy companies. CSO Online reports Dream's assessment that the attacker "gained a persistent foothold inside state infrastructure."
Accounts differ on how severe the confirmed impact was. Tenable, citing the Ministry of Digital Affairs confirmation, describes accounts compromised and records exfiltrated as established fact. But a Dream spokesperson told CSO Online that its research "did not find evidence of a confirmed breach of the entity's systems," a materially softer position than the firm's own blog language. Taiwan's Ministry of Digital Affairs, for its part, said attack sources, methods, and scope of impact "have all been fully investigated, and the affected units have successively completed their handling." Readers should treat the compromise as confirmed by the victim government and the record counts as researcher-derived from attacker logs rather than from a victim disclosure.
What Was Taken
The exfiltrated material is personnel data rather than classified operational content, based on available reporting. Sources describe names, departments, and single sign-on account identifiers retrievable from unauthenticated API endpoints. Volume estimates cluster tightly at 2,500-plus records, with Tenable's 2,564 the most specific figure published. Eighty-five employee accounts were cracked, giving the operator authenticated access on top of the unauthenticated data pull.
Dream also reported that one system exposed its entire user database without any authentication, described as containing thousands of entries. That is a broader exposure than the 2,500 exfiltration count and should be read as available-to-the-attacker rather than confirmed-taken.
The sensitivity here is not the individual field values. It is that names, departments, and SSO identifiers for government staff are exactly the input set required for follow-on credential stuffing, targeted phishing, and identity-based lateral movement, which is what the 85 cracked accounts represent.
Why It Matters
Tenable's RSO team has tracked this activity since July 21, 2026 as part of a seven-incident agentic AI cluster spanning November 2025 through August 2026, and calls Taiwan the anchor finding rather than an isolated event. The cluster includes JADEPUFFER, which exploited CVE-2025-3248 in the Langflow AI workflow platform for automated database extortion, and the knaithe/KnYuan operator documented independently by Palo Alto Networks' Unit 42.
Unit 42 published its own findings on July 30, 2026, attributing an AI-enabled autonomous hacking campaign to a Chinese-speaking threat actor using DeepSeek via the Hermes Agent framework, orchestrated over Telegram. That actor independently enumerated targets using FOFA, sourced exploit tools, and initiated attacks without human intervention. Unit 42 also observed the actor configuring Qwen, GLM, Kimi, and MiniMax, with limited testing of Western platforms including Claude Code for connectivity and proxy validation and signs of Codex use in exploit development directories. Unit 42 characterizes its actor assessment as moderate confidence per Tenable's summary. While Unit 42 noted its observed campaign had limited impact, it assessed the workflow as a functional end-to-end autonomous offensive capability.
The same framework has appeared elsewhere in the region. BleepingComputer reported on July 24, 2026 that a threat actor ran Hermes in unattended "YOLO" mode to automate post-exploitation against Thailand's Ministry of Finance. Hunt.io and researcher Bob Diachenko found three simultaneously exposed directories on a Hong Kong-hosted server between July 9 and July 13, holding 585 files totaling roughly 470 MB including web shells, tunneling tools, stolen credentials, and Hermes agent logs. Thailand's Ministry of Finance has not confirmed a breach, and some recovered artifacts show only targeting rather than successful compromise.
The consistent operational lesson across the cluster, per Tenable, is that identity and authentication exposure is the common entry point: discoverable federation endpoints, weak credentials, and misconfigured SSO.
The Attack Technique
The intrusion started with client-side reconnaissance and pivoted to server-side weakness. The agents downloaded and analyzed JavaScript bundles from a single government portal, extracting embedded URLs, API endpoints, OAuth client IDs, Keycloak configuration objects, and authentication details. That one portal was enough to enumerate 21 connected government systems and every supported authentication flow.
From there, the framework discovered more than 36 API endpoints on a single target, spanning account management, user data retrieval, file upload, and administrative functions, many of them completely unauthenticated. The agents also harvested publicly available SSO integration documentation and SDK examples to refine their understanding of the authentication surface.
Critically, while the framework flagged several potential client-side weaknesses, the confirmed compromises traced to server-side failures: unauthenticated APIs, insecure authentication endpoints, and weak token validation. No zero-days are described in any source.
On the autonomy question, security practitioners quoted by SC Media pushed back on "fully autonomous" framing. Kevin Surace, CEO of TokenCore, said he would "describe it as near-autonomous rather than completely independent," noting humans still selected targets, defined objectives, assembled the framework, and reportedly persuaded the underlying model that the operation was an authorized security test, with the AI then exercising considerable operational freedom inside that mission.
Attribution rests on language artifacts, not infrastructure. Dream reported that operational documentation used Simplified Chinese for internal reporting and Traditional Chinese for target analysis, which it said "points to a Chinese-language operator." Dream did not attribute the campaign to the Chinese government or a named group, and Taiwan did not name a responsible country.
What Organizations Should Do
-
Audit every API endpoint reachable from a public portal for authentication. The confirmed compromises here came from unauthenticated endpoints exposing user data, not from novel exploits. Enumerate what an unauthenticated caller can actually retrieve, including account management and administrative functions.
-
Treat your own JavaScript bundles as attacker reconnaissance material. OAuth client IDs, Keycloak configuration objects, internal API paths, and federation endpoints embedded in front-end code gave the agents a full map of 21 systems from one portal. Strip configuration from client-side bundles and assume anything shipped to a browser is public.
-
Harden token validation and authentication endpoints specifically. Weak token validation was named as a root cause. Verify signature checking, audience and issuer validation, expiry enforcement, and revocation across every service in the SSO trust fabric, not just the identity provider.
-
Enforce phishing-resistant MFA on all staff SSO accounts. Eighty-five accounts fell to credential attacks. Password-only or push-based MFA does not survive machine-speed credential attempts driven by harvested employee identifiers.
-
Instrument detection for machine-speed enumeration. Twelve attack waves ran in four days with eight parallel agents. Rate-based and volumetric anomaly detection on API access, failed authentication, and endpoint discovery patterns is now a primary control, not a secondary one.
-
Extend the same review to supply-chain vendors and connected agencies. The Register reports the campaign expanded from core government systems to a nuclear safety agency, vendors, and energy companies. Federation trust relationships propagate identity compromise outward, so scope the audit to everything your SSO trusts and everything that trusts it.
-
Monitor for exposed attacker infrastructure as an intelligence source. Both the Taiwan and Thailand cases were uncovered through misconfigured, publicly exposed directories holding agent logs. Agentic tooling is verbose, and that verbosity is currently a defender advantage.
Sources: Eight AI Agents Breach Government Systems, Crack 85 Accounts and St... | Agentic AI Threat Cluster: What It Means for Your Exposure | Chinese-Speaking Threat Actor Harnesses AI Models for ... | 'Near-autonomous' AI agents attack Taiwan's nuclear safety agency | AI agents wage near-autonomous cyberattack on Asian ... | Researchers observe first ‘near-autonomous’ AI attack on government... | Taiwan confirms AI-assisted cyberattack on government systems news... | Hermes AI agent used to automate attack on Thai Finance Ministry