Taiwan's near-autonomous AI attack ran on open-source agents

Taiwan's Ministry of Digital Affairs confirmed today that government agencies were hit last month by a cyberattack driven largely by AI agents. The detail that should get your attention isn't the target — it's the toolkit. This near-autonomous AI attack was assembled from open-source agent frameworks anyone can download, including the same class of harness your developers use to automate their own work.

What actually happened

Taiwan's National Institute of Cyber Security began issuing alerts on July 20, per Reuters. The ministry said the campaign showed clear characteristics of an overseas source and combined manual operation with AI agent assistance, naming Open Claw specifically. It also said attack sources, methods, and scope were fully investigated and affected units have completed remediation. The justice ministry lost personnel records; a nuclear safety agency was scanned for vulnerabilities.

The technical account comes from Dream, the Israeli security firm that found the campaign and whose work CyberScoop reported:

• Agents worked together across four days in July, adapting mid-operation without human intervention.
• Dream recovered a 160 MB archive of nearly 1,400 files left behind by the operation.
• More than 2,500 personnel records were extracted.
• The framework ran what Dream calls "Learning Cycles" — autonomous sessions that searched vulnerability databases, GitHub, and security publications for exploitation techniques to apply next.
• Targeting spread from the initial agencies to government IT supply-chain vendors, a government email system, and seven or more energy companies.

Two open frameworks are named: Hermes and OpenClaw. Attribution stops at "suspected Chinese," and researchers quoted by Reuters were careful to note a human still sets the objectives. Dream also notes these systems take real engineering to tune — coordination logic and decision rules don't come free.

Why autonomous attack tooling matters for your business

The economics of being targeted just changed. A campaign like this used to require an operator's full attention per target, which is why small businesses mostly got hit by untargeted spray. When the loop is a downloadable framework plus a token budget, the marginal cost of adding your company to the list approaches the cost of the tokens. You are now inside the addressable market for targeted intrusion.

Two operational consequences. First, the "Learning Cycles" pattern means the gap between a public CVE and an attempt against your stack is now measured in hours, not the weeks your patch cadence assumes. Second, the interesting movement here was lateral — into supply-chain vendors and adjacent sectors. Perimeter alerts don't catch an agent that authenticated with harvested credentials and then browsed. What catches it is monitoring that flags a single identity touching twenty systems in ten minutes, because no human works that way.

Also worth sitting with: the same frameworks are in your developers' toolchain. That's not an argument to ban them — it's an argument to know which agents run in your environment, what credentials they hold, and what they can reach. We've written about scoping agent egress and what happens when nobody watches the agent live. This is the same lesson from the other side of the wire.

Sources: CyberScoop, Taipei Times / Reuters.