Threat · curated 12 Aug 2026
Subscribe to read
First reported ft.com
Coverage timeline
Single-source incident — first reported, latest, and curated coincide.
Why it matters
The Taiwan nuclear-safety agency intrusion is one of the first documented real-world compromises driven largely by autonomous multi-agent AI frameworks, demonstrating that publicly available AI agents can independently perform reconnaissance, credential attacks, and exfiltration at machine speed against government targets.
Security firm Dream reported a 'near-autonomous' AI-agent attack that compromised Taiwanese government systems, its nuclear safety agency, supply-chain vendors, and at least seven energy companies over July 1-4, 2026. Built on open-source Hermes and OpenClaw AI agents, the framework deployed up to eight sub-agents across 12 attack waves to map government infrastructure, crack 85 accounts via password-spraying, solve CAPTCHAs, and exfiltrate over 2,564 personnel records, SSO client secrets, and database credentials.
Summary
Israeli cybersecurity firm Dream reported that suspected Chinese operatives ran a 'near-autonomous' AI-agent operation against Taiwanese government systems over the first four days of July 2026, compromising 85 government user accounts and exfiltrating more than 2,500 personnel records before expanding the intrusion to a nuclear safety agency, IT supply-chain vendors, a government email system, and at least seven energy-sector companies.[0]
The operation was built on open source Hermes and OpenClaw AI agents, deploying up to eight sub-agents across 12 'attack waves' between July 1 and July 4, and was uncovered through a 160 MB online archive of 1,395 files documenting the campaign. Dream did not attribute the activity to the Chinese government or a named group, but said the operational documentation points to a Chinese-language operator.[0]
Attack chain
- Reconnaissance and attack-surface mapping: AI agents mapped the government ecosystem, extracting embedded URLs, API endpoints, OAuth client IDs, and Keycloak configuration objects from a single government portal, identifying 21 connected government systems and every supported authentication flow. On one target it discovered 36+ API endpoints, many unauthenticated, including one system exposing its entire user database without authentication.[0]
- Initial access via exposed endpoints: The agents found multiple entry points, including three hidden API endpoints that accepted any request body and returned a valid authenticated session without requiring user credentials.[0]
- Credential access and account compromise: Using employee usernames harvested from an unauthenticated API, the agents broke into a department office automation portal, solved its CAPTCHAs with 100 percent accuracy, tested predictable password patterns based on employee IDs, and cracked 85 accounts across multiple password-spray rounds; 84 of them authenticated to the department's internal information system.[0]
- Data exfiltration: The access allowed the agents to exfiltrate more than 2,564 personnel records, a full JSON export of all department system users, seven SSO client secrets, six internal database credentials across MSSQL, Oracle, and Sybase, and internal network IP ranges.[0]
- Lateral expansion to supply chain and critical infrastructure: The agents pivoted to government IT supply-chain vendors, a nuclear safety agency, a government email system, and 7+ energy-sector companies, scanning them in parallel for misconfigurations, exposed admin interfaces, and exploitable vulnerabilities.[0]
- Autonomous learning and self-correction: The framework ran autonomous 'learning cycles' searching vulnerability databases, GitHub repositories, and security research for specific techniques, CVEs, and weaknesses, and self-corrected its own errors through a verification process.[0]
Disclosure timeline
| Date | Event |
|---|---|
| July 1–4, 2026 | AI agents conducted the intrusion across 12 attack waves, compromising government accounts and expanding to a nuclear safety agency, supply-chain vendors, and energy companies.[0] |
| August 12, 2026 | Dream published its research detailing the multi-agent AI framework; the Financial Times first reported the research and identified Taiwan as the target, and The Register covered it.[0] |
Actor profile
Suspected Chinese-language operator
Dream did not attribute the operation to the Chinese government or a specific hacking group, but said the operational documentation points to a Chinese-language operator. The Register characterized the actors as suspected Chinese cyber operatives targeting Taiwan.[0]
How it works
The intrusion exploited insecure API design and misconfiguration rather than a single named CVE: a government portal leaked embedded URLs, API endpoints, OAuth client IDs, and Keycloak configuration objects; one system exposed its full user database with no authentication; and three hidden API endpoints returned valid authenticated sessions for any request body without credentials. The agents also exploited predictable, ID-based password patterns via password spraying and automated CAPTCHA solving.[0]
Key takeaways
- The operation demonstrates that AI-orchestrated, near-autonomous offensive agent collectives are now being used in real intrusions, capable of mapping attack surfaces, self-correcting errors, and running autonomous 'learning cycles' against live targets.[0]
- Basic security failures—unauthenticated APIs, exposed user databases, hidden session-granting endpoints, and predictable passwords—remained the decisive weaknesses that the AI agents exploited at scale and speed.[0]
Defensive actions
- Audit and lock down API endpoints, removing unauthenticated access to user data, account management, file upload, and administrative functions.: The agents discovered 36+ API endpoints, many completely unauthenticated, and one system exposed its entire user database without authentication.[0]
- Eliminate hidden or undocumented endpoints that issue authenticated sessions without credential validation.: Three hidden API endpoints accepted any request body and returned valid authenticated sessions without requiring user credentials.[0]
- Enforce strong, non-predictable password policies and multi-factor authentication, and monitor for password-spray activity.: The agents cracked 85 accounts by testing predictable password patterns based on employee IDs across multiple password-spray rounds.[0]
- Rotate and secure SSO client secrets, database credentials, and protect exposed OAuth/Keycloak configuration.: Exfiltrated data included seven SSO client secrets, six internal database credentials, and Keycloak configuration objects usable for further compromise.[0]