From July 1 to 4, 2026, a cyberattack was carried out against Taiwan's government and energy systems, in which researchers at Israeli company Dream observed the operation of a 'near-autonomous' AI tool built on open frameworks Hermes and OpenClaw. Over four days, the multi-agent system conducted 12 attack waves, compromised government employee accounts, and exfiltrated HR data, SSO secrets, and database credentials.
What happened
The operation consisted of 12 'attack waves' over four days, during which the system deployed up to eight sub-agents, each with its own goals and techniques. The agent solved CAPTCHAs with 100 percent accuracy and conducted password-spraying, brute-forcing password variations based on templates. 85 government employee accounts were compromised, of which 84 successfully accessed internal systems. The attackers exfiltrated more than 2,564 HR records, a full JSON export of users, 7 client SSO secrets, and 6 database credentials for MSSQL, Oracle, and Sybase. The operation expanded to the Nuclear Safety and Control Commission, the government postal system, IT equipment suppliers, and at least seven energy companies, with a total attack surface of 21 interconnected systems.
Context
The key to understanding the incident is not a new AI model, but orchestration: the tool is built on publicly available open frameworks Hermes and OpenClaw, and the defining value lies in the quality of task decomposition and agent management. Financial Times links the attack to hackers with Chinese ties, while The Guardian reports that Taiwan authorities stated there was an 'anomalous' attack using AI. The evidentiary basis for describing the incident is the attackers' own documentation, a 160 MB archive with 1,395 files, and a report by research company Dream.
Why this matters for the industry
The incident is described as the first documented end-to-end offensive cycle led by AI agents against government systems: not an assistant in human hands, but a multi-agent system that itself reordered attack paths as data was collected and replaced a failed branch with a new agent. Since the build relies on public frameworks, the barrier to entry for other actors is low, and copying techniques is likely in the short term. For the market, this is a signal that basic offensive agent capabilities are becoming cheap and reproducible, and the competitive moat at the framework level disappears: value shifts to the pure internal environment, disciplined secrets, closed endpoints, and observability with an audit trail. For regulators and critical infrastructure operators, the incident became a direct reason to close unauthenticated APIs, rotate SSO secrets, and include IT chain suppliers in the protection perimeter, and for security vendors it opened demand for agent security and AI attack surface analysis products.
Why this matters for users
The practical lesson of the incident is that the attack did not go through a core hack or zero-day, but through typical holes: open APIs without authentication, an exported employee database, predictable passwords based on employee ID, and outdated CAPTCHAs. For organizations, this is a specific checklist: inventory public API endpoints and check authentication on each, determine who has access to SSO secrets, ensure that passwords are not built from a template based on employee data, and audit CAPTCHA solutions. The assumption that CAPTCHA protects against automation has been effectively removed from the working account: in this incident, agents solved them with 100 percent accuracy. For an individual specialist, this is a reminder not to use template passwords from personal data and to monitor access rights of their own accounts.
What is still unknown / limitations
The name and architecture of the AI model used are not disclosed, so claims about capabilities cannot be attributed to a specific model, and conclusions about the maturity of AI agents remain unverifiable. The qualifications 'near-autonomous' and '100 percent CAPTCHA accuracy' are presented as an observation of a single incident without methodology, sample size, and independent validation. The evidentiary basis consists of the attackers' own documentation and a report from one research company Dream, with no independent replication of the results. Some actions in the operation, as indicated in the sources, were performed manually by hackers, and the agent supplemented manual actions, so no source provides a quantitative metric for the degree of system autonomy.
Sources
Author
Look at AI, editorial team