Hackers Used AI Agents Against Taiwan. Who Controlled the Hack?

A cybersecurity operations display showing AI-agent attack paths converging on Taiwan, with the words Who Controlled the Attack?

Written by

Andrew McDonald

in

Taiwan confirmed that overseas hackers combined conventional
methods with AI agents against government agencies. Dream Research Labs
says as many as eight agents worked in parallel, but the operator, full
impact and degree of autonomy remain unconfirmed publicly.

A person or group selected Taiwan’s government systems as a target.
AI agents then helped search, test and adapt the attack.

Taiwan has confirmed that hybrid operation. It still has not publicly
identified who controlled it or validated every claimed breach.

That uncertainty matters because the attack changes what one operator
may be able to do. It does not remove the person behind the system.

What Taiwan confirmed

On 13 August, Taiwan’s Ministry of Digital Affairs said its
cybersecurity monitors had detected abnormal attacks against government
agencies during July. The National Institute of Cyber Security began
issuing alerts on 20 July while authorities investigated and
responded.

The Ministry said the attacks showed clear signs of overseas origins.
Hackers combined conventional methods with AI agents, including
OpenClaw. The agents could rapidly connect different techniques and use
backup and testing environments as stepping stones. That made the
activity faster, cheaper and easier to scale.

The Ministry said its investigation into the source, methods and
scope was complete. Affected agencies had completed remediation.
Government protection guidance, system monitoring and cross-agency
intelligence sharing had also been strengthened.

Immortal AI asked the Ministry to confirm the reported number of
compromised accounts and personnel records, whether nuclear-safety or
energy organisations were breached rather than scanned, whether people
were notified, which controls failed and whether a state directed the
attack.

In its 24 August response, the Ministry repeated and expanded its
account of the overseas hybrid attack, its use of backup and testing
systems and the completed remediation. It did not answer those specific
questions.

The official evidence therefore establishes a real AI-agent-assisted
attack against government agencies. It does not establish the identity
of the operator, state sponsorship, the complete list of affected
organisations or the detailed impact figures reported elsewhere.

What Dream says happened

The more detailed account comes from Dream Research Labs, an Israeli
cybersecurity company that says it recovered the attack framework’s
complete operational workspace.

Dream says the system used the publicly available Hermes and OpenClaw
frameworks. Across 12 attack waves over about four days, it allegedly
deployed as many as eight sub-agents in parallel. Dream says the agents
mapped 21 connected government systems, cracked 85 employee accounts and
extracted 2,564 personnel records. It also says the operation scanned a
nuclear-safety agency, government suppliers and at least seven energy
companies.

Dream’s report contains detailed descriptions of the framework and
attack paths. Its underlying archive is not public, however. Reuters
reported that Dream did not provide the recovered data for independent
inspection.

The figures should therefore be treated as Dream’s findings. Taiwan’s
official statements confirm the broader attack and the use of AI agents
but do not independently validate each number.

A hacking team built from
software

The system Dream describes did more than run automated scans.

Separate agents were assigned different targets and techniques. They
gathered information from exposed applications, tested credentials,
reviewed authentication systems and searched public vulnerability
sources when an approach failed. Results from one wave informed the
next.

Dream says the framework ranked possible vulnerabilities and attack
paths using probability scores. It recorded false positives and retested
them. In one case, it initially interpreted a delayed response as
evidence of a database attack, then rejected the finding after further
testing showed that an email timeout caused the delay.

This ability to divide work, retain results and change direction is
why the case matters. Automation has assisted hackers for years. A
coordinated agent system can organise the work while performing parts of
it.

One operator may therefore be able to apply sustained pressure across
many systems without maintaining a conventional hacking team. The
technology does not need to invent a new vulnerability to change the
risk. It can reduce the labour needed to find old weaknesses, reuse
credentials and move through poorly separated systems.

Dream says the successful intrusions relied on familiar failures,
including unauthenticated interfaces, exposed development endpoints,
predictable passwords, weak token validation and connected systems that
trusted compromised sessions. AI did not create those weaknesses. It
allegedly helped find and exploit them at scale.

Autonomous does not mean
unaccountable

Dream calls the operation near-autonomous. Taiwan describes hackers
using AI agents in a hybrid attack. The difference is important.

A person or group still chose the target, set the objective,
assembled the tools and began the operation. People could review
results, redirect the campaign or use information obtained from it.
There is no evidence that the agents independently developed a political
purpose or chose Taiwan as a target.

Other cases support this more careful interpretation.

In November 2025, Anthropic reported disrupting a cyber-espionage
campaign that it assessed with high confidence was connected to a
Chinese state-sponsored group. Anthropic said its model performed much
of the operational work, while people selected targets and intervened at
critical points.

In July 2026, Palo Alto Networks’ Unit 42 documented a separate
Chinese-speaking actor using Hermes Agent and DeepSeek for autonomous
scanning and attempted exploitation while conducting other work
manually.

The pattern is emerging. People remain in command while agents
perform more of the research, testing and repetitive execution.

That should make responsibility clearer. An operator cannot avoid
accountability because software completed individual steps.

Safeguards can be
manipulated

Dream says the Taiwan framework bypassed model refusals by presenting
the work as authorised penetration testing. Anthropic reported a similar
technique in 2025, when attackers divided malicious work into smaller
tasks and told the model it was supporting legitimate defensive
testing.

If a system relies heavily on the operator’s description, a dishonest
operator can use the language of safety to obtain offensive
assistance.

Immortal AI asked Nous Research and OpenClaw whether they had
examined Dream’s evidence, whether an authorised-testing story could
bypass current safeguards and what controls restrict credential attacks,
exploitation and coordinated offensive activity. Neither responded by
the 24 August deadline.

Their silence does not establish that their safeguards failed or that
the maintainers approved the use. Hermes and OpenClaw are frameworks.
Responsibility for the attack remains with the people who configured and
directed the system. The unanswered questions concern whether
maintainers can detect, restrict or discourage foreseeable misuse.

Attribution remains
unresolved

Some reports have described the operators as China-linked. The public
evidence does not support presenting that as settled.

Dream says internal material used Simplified Chinese while
target-facing analysis used Traditional Chinese. It concluded that the
framework pointed to a Chinese-language operator but did not attribute
the attack to a named group or government. Taiwan said the attack came
from overseas and did not name China.

Language can support an assessment. It is not proof of state
direction.

Taiwan has separately reported extensive Chinese cyber activity
against critical infrastructure. That background makes possible Chinese
involvement relevant. It does not identify who controlled this
attack.

The supported conclusion is narrower. Taiwan confirmed an overseas,
AI-agent-assisted attack. Dream’s evidence suggests a Chinese-language
operator. The operator and any state sponsorship remain unconfirmed
publicly.

The cost moved to the
defender

The deepest change may be economic.

The attacker described by Dream assembled public agent frameworks,
open information and ordinary offensive tools into a coordinated system.
If that account is accurate, a smaller group can generate work that once
required more people, time and specialist coordination.

The defender does not receive the same discount. Government systems
still need strong identity controls, repaired legacy applications,
separated testing environments, monitored suppliers and people able to
respond at any hour.

Taiwan says it has strengthened protection guidance, monitoring and
coordination between agencies. Its earlier guidance for OpenClaw also
called for isolated environments, minimum permissions and mandatory
human review for high-risk actions.

Those controls address hostile agents outside an organisation and
powerful agents operated inside it.

What organisations can do now to protect themselves

  • Require multi-factor authentication and remove predictable or reused
    passwords.
  • Review unauthenticated interfaces, development endpoints and testing
    systems exposed to the internet.
  • Treat single sign-on as critical infrastructure and limit how far
    one compromised session can travel.
  • Separate agent tools from sensitive systems and give them
    short-lived, minimum permissions.
  • Require human approval for credential access, software execution and
    other high-risk actions.
  • Monitor behaviour across identities and systems rather than relying
    only on known malware signatures.
  • Include suppliers, backup systems and testing environments in
    security reviews.

The Taiwan case does not show that AI chose to attack a country. It
shows that people can use AI agents to accelerate and coordinate a real
attack.

The important question is no longer whether the agents were
completely autonomous. It is whether accountability, safeguards and
public defences can operate at the speed of the systems people can now
deploy.

Editorial disclosure: Immortal AI used AI tools to assist
research, source organisation and drafting. Material claims were checked
against the sources listed below. Taiwan’s Ministry of Digital Affairs
responded to Immortal AI’s fair-response questions. Nous Research and
OpenClaw did not respond by the stated deadline.

Related reporting

Principal sources

Comments

Leave a Reply

Your email address will not be published. Required fields are marked *

More posts