AI Agents Breached Taiwan's Government in Four Days

Between July 1 and 4, 2026, a set of artificial intelligence agents breached Taiwanese government networks almost entirely on its own. In four days, it compromised 85 user accounts, extracted more than 2,500 personnel records, and expanded into the country's nuclear safety agency and at least seven energy companies.

The case was documented by the Israeli security firm Dream, in an analysis published on August 11. Researchers call the episode the first "near-autonomous" attack against a government target — and it's worth holding onto that "near," because it matters: there was human direction, just minimal.

The detail that should keep anyone responsible for systems up at night isn't the target. It's the tool.

What the agents did without supervision

• Ran up to eight agents in parallel, each with its own targets and techniques.
• Carried out 12 attack waves in four days.
• Conducted simultaneous reconnaissance on 21 government systems.
• Mapped networks, probed weaknesses, cracked credentials, and exfiltrated data in sequence.
• Switched tactics whenever blocked, without waiting for instructions.

The analysis came from material the group itself left exposed on the internet: a 160 MB file with 1,395 log records. Inside it, researchers found Bayesian decision engines, learning cycles, and self-correction routines. This wasn't a script running in a loop — it was a system that evaluated outcomes and adjusted its own plan.

The uncomfortable part: the tools are public

The system wasn't built with secret state technology. It was assembled on top of two open agent frameworks:

• Hermes, an agent framework released by Nous Research in February 2026.
• OpenClaw, a personal AI assistant launched in November 2025, which racked up 340,000 GitHub stars in under six months.

These are legitimate projects, built to automate work — probably similar to what your team already uses or will use. There's nothing wrong with them. What's changed is that the same piece that organizes office tasks organizes intrusion tasks, and nobody has to rebuild it from scratch.

How the guardrails fell

This is the line that should circulate most widely among managers: the model's protections were bypassed by framing the intrusion as an authorized penetration test.

That's it. No sophisticated exploit against the model, no elaborate jailbreak. All it took was the right framing — a sentence of context — for the system to treat the operation as legitimate security work.

The practical lesson applies to any company putting agents to work: a model guardrail is not access control. It filters stated intent, and stated intent is the easiest thing in the world to fake. Anyone relying on "the AI won't do that" as a security layer is standing on paper.

Why this changes the math for your company

The natural reaction is "this is cyberwarfare between countries, it has nothing to do with me." It does, and for a simple economic reason.

Sophisticated attacks have always been expensive because they required people: expensive specialists, in numbers, for weeks. That cost worked as an implicit protection for small companies — nobody was going to spend an entire team to breach a mid-sized distributor in a small town.

What this operation demonstrates is that the cost of running an offensive team has collapsed. Eight agents running in parallel for four days is not an expensive team. And the target no longer needs to be important to be worth it — it just needs to be easy.

It's the same shift we described in another piece about AI finding security flaws faster than companies can fix them, seen from the other side of the counter: there, AI finds the problem; here, it executes the entire attack.

What you can do, in order of return

1. Two-factor authentication everywhere possible. The attack cracked credentials and used legitimate accounts. A password alone, no matter how strong, no longer holds up against an automated operation.
2. Delete accounts nobody uses. Former employee and old vendor accounts are the preferred door — nobody notices activity on them.
3. Watch speed, not just volume. The signature of this type of attack is pace: reconnaissance across 21 systems at once isn't human behavior. Alerting on abnormal speed patterns catches what alerting on volume misses.
4. Keep logs and know how to read them. The entire campaign was reconstructed from records. Without logs, you don't know if you were hit — and most companies discover a breach months later.
5. Treat what's exposed on the internet as a priority. What the world can see is what agents scan first.

None of this is exotic or expensive. It's basic hygiene — just now against an adversary that doesn't sleep and doesn't charge overtime.

Two months later: websites at more than 100 companies

On October 19, 2026, Reuters showed that the method had moved from a government target to businesses. According to researcher Snorre Fagerland of security firm NorForge, a Chinese-speaking hacker used AI agents to attack more than 1,200 websites and got into those of more than 100 companies, including Deere, owner of the John Deere brand, appliance maker SharkNinja, and engine maker Cummins. The campaign began in late September.

Three details matter to any business, of any size:

• The way in was not the main website. At SharkNinja it was a separate product support site. At Cummins, a site run by a third-party vendor. These are pages that exist, are online, and nobody checks every day.
• The cost is low. The researcher estimates about $50 per successful intrusion, but warns that the figure is uncertain because he had no access to the tools’ usage data.
• The tool, once again, was public. The agents were coordinated through exposed installations of Cairn, an open-source AI automation project. Its creator said the platform “was never a hacking tool.”

The companies say they contained the problem, and it is not known how much data was taken. The message, however, is the same as in the Taiwan case, now at commercial scale: the agent sweeps thousands of addresses and gets in wherever it is easiest.

The forgotten website is the easiest way in

Almost every business has pages nobody remembers exist. Before thinking about expensive tools, take this inventory:

1. List everything online with the company’s name on it: the main site, the microsite from an old promotion, the store that was tested and abandoned, the blog at another address, the sign-up page for a past event.
2. Ask who updates each one. If the answer is “nobody” or “the previous agency,” take it down or assign someone to look after it.
3. Check the subdomains. Addresses like “promo.” or “test.” in front of the site name tend to be left behind. Whoever manages the domain can list them all in minutes.
4. Include your vendors. If a partner runs a site or form that receives your customers’ data, ask how they update and protect that page. That is how Cummins was hit.
5. Change passwords and turn on two-factor authentication on the control panels for hosting, domain, and administration of every site that stays online.

If you can’t answer these questions about your own site, our website creation team takes that inventory and handles the updates.

The honest summary

Two caveats, so as not to overstate the case. The first: researchers say "near-autonomous," not autonomous — there was a human in the loop, even if a minimal one. The second: attribution to China is probable, not proven. Dream did not name a group; it relied on the fact that the internal logs alternated between Simplified Chinese in status reports and Traditional Chinese in target analysis.

And there's an irony here: this entire analysis exists only because the group forgot 160 MB of logs exposed on the internet. Attackers get the basics wrong too.

What isn't a caveat, but the central fact: the barrier to entry for a coordinated attack has fallen, and it fell using software anyone can download today.

Facts compiled from Dream's technical analysis, published August 11, 2026, and coverage by CNN, The Register, and CyberScoop. Taiwan estimates it detected an average of 2.6 million daily cyberattack attempts of Chinese origin in 2025.