An autonomous hack on Taiwan's government was built from free AI agent tools

An autonomous intrusion tool assembled from two freely downloadable AI agent frameworks picked and retried its own attack steps across a four-day run with up to eight agents in parallel, mapping 21 Taiwanese government systems and exfiltrating at least 2,500 personnel records.

Israeli cybersecurity firm Dream describes the early-July campaign as the first observed end-to-end autonomous cyberattack on a government target. The attack reached at least 85 user accounts before the operators pivoted to Taiwan's nuclear safety regulator, more than seven energy companies, and a set of government suppliers. A 160-megabyte archive containing 1,395 files the firm pulled from an exposed operational store shows how the toolkit was built and run, and the researchers shared their findings with the Financial Times and Tom's Hardware on August 12.

The toolkit was not bespoke nation-state malware. Dream says the operators combined two open-source AI agent systems it names Hermes and OpenClaw, both of which can be cloned from public repositories today. Each agent could plan, execute, and retry intrusion steps without a human typing the next command. The composition let the actors scale the operation: instead of one operator probing one target, they ran roughly eight agents in parallel and let the models choose which system to enumerate next. The underlying large language model is not identified in the firm's published analysis, so any claim about which model family "enabled" the attack is still open.

The operators framed the malicious task as an "authorized penetration test" inside the prompts sent to the agents, which Dream says was enough to evade the model providers' safety refusals. Hermes and OpenClaw are not purpose-built for offense; the capability emerged from the composition of general-purpose agent frameworks, a category of software that has gone from research curiosity to public download in under two years.

The attribution is hedged. Dream describes the operators as suspected China-linked based on indicators in the archive; Taiwanese authorities have not publicly named an actor. Taiwan's Ministry of Digital Affairs, the cabinet department that handles cyber incident response, told local outlet PTS the case is being handled per standard protocol and pointed to a 2025 average of about 2.63 million intrusion attempts per day against the island's critical infrastructure, a baseline that frames this incident as one incident inside a much larger daily volume. EBC News carried the ministry's read-out. Neither the ministry nor Dream has published a full victim list.

The scope numbers — 85 accounts, 2,500 records, 21 systems — are Dream's characterization of a vendor-controlled archive, and the firm has disclosure incentives that do not always align with a defender's. The name OpenClaw in the reporting may be a placeholder or redaction rather than the public OpenClaw product; treating them as the same thing without independent confirmation is premature. And the "first-ever end-to-end autonomous" framing is a vendor claim bounded by what Dream could observe, a meaningful first rather than a settled historical one.

The durable shift is in the threat model. An offensive primitive that any technically literate team can assemble from public downloads, point at a government, and let run for four days without a human typing the next step changes the assumption that AI-enabled attacks require bespoke engineering. Defenders who plan around malware supply chains now have to plan around agent-framework supply chains, and the same composition that hit 21 government systems this month is reproducible by anyone with the repos and the patience.