The attack kept running while the attackers slept

Here's the deal: over four days, July 1 through July 4, 85 user accounts inside Taiwan's government were compromised and more than 2,500 personnel records walked out the door. And it didn't stop there. The operation spread to government IT supply chain vendors, a government email system, the country's nuclear safety agency, and seven-plus energy sector companies.

So far that reads like a familiar state-sponsored intrusion. What makes this one different is who executed it. No human sat at a keyboard issuing commands step by step. A framework assembled from open-source AI agents ran up to eight sub-agents in parallel, deciding and acting on its own from reconnaissance through breach through lateral spread.

The world found out via a report published August 12 by Dream, an Israeli cybersecurity firm. The Financial Times reported it first; CNN, The Register, and CyberScoop confirmed the details afterward. How Dream's researchers found the operation is its own story: a 160 MB archive left exposed on the internet, containing 1,395 files documenting the entire campaign.

The security industry has been warning about AI-automated attacks for years. This one gets treated as an inflection point because it wasn't a lab demo — it ran against a real government target, and it worked. OpenAI's Michael Dalton put it plainly: "AI orchestrated, fully automated offensive attacks are real now."

Who's in this story

Dream is an Israeli AI-driven cybersecurity company focused on defending national infrastructure. Its report is a reverse-engineering of the attacker's own archive. Notably, the firm did not name a sponsor. It says it identified traces of a Chinese-language operator in the operational documents, but stopped short of attributing the campaign to Beijing or to any specific hacking group. Attribution carries political weight, and Dream stayed cautious.

The attack framework was built on two open-source agent systems: Hermes and OpenClaw. Both are public code, and both were built for ordinary automation work. The attacker didn't develop a novel hacking tool. They took existing agent frameworks and orchestrated them for offensive work.

That distinction matters, and Dream's researchers stressed it. Getting the framework to run required "careful adjustment to the specific task, optimization of agent coordination, and fine-tuning of decision logic" — including Bayesian prioritization, self-correction loops, and adaptive research cycles. So this is not "someone told an AI to hack Taiwan and it did." It's the output of a skilled operator spending weeks designing and tuning a system.

The target was the Taiwanese government. The initial entry point was a single government portal, and what the agents scraped out of it is instructive: embedded URLs, API endpoints, OAuth client IDs, and Keycloak configuration objects. Stitching those fragments together, they mapped 21 connected government systems and every supported authentication flow.

On top of that map, they found 36+ API endpoints spanning account management, user data retrieval, file upload, and administrative functions — and in Dream's words, many of them were completely unauthenticated. That part of this story is less about AI than about basic security hygiene.

How the operation actually ran

Here's the shape of the campaign.

Item Detail
Window July 1–4, 2026 (four days)
Attack waves 12
Sub-agents Up to 8, each with its own targets and techniques
Base tooling Hermes, OpenClaw (both open source)
Accounts breached 85 government user accounts
Data exfiltrated 2,500+ personnel records
Systems mapped 21 government systems, 36+ API endpoints
Spread IT supply chain vendors, government email, nuclear safety agency, 7+ energy firms
Discovery 160 MB internet-exposed archive, 1,395 files
Disclosed August 12, 2026 (Dream report)

The two rows to sit with are "8 sub-agents" and "12 waves." Each agent handled its own targets and techniques, working in parallel. In human terms, that's eight people working simultaneously for four days without shift changes. Except these eight never sleep, share findings with each other in real time, and log every failed attempt so the next one starts smarter.

The autonomy lived in what Dream calls "Learning Cycles." When an approach stalled, one agent went out and searched vulnerability databases, GitHub repositories, and security publications for applicable techniques, then fed what it found back into the framework and tried again. Nobody had to say "that didn't work, try this instead."

Prioritization was automated too. The framework continuously re-ranked possible attack paths as new information came in. That matters because choosing what to try next is exactly where skill gaps show up in offensive security. There are hundreds of possible paths and finite time. Automating that judgment removes the expertise bottleneck.

Practical defenses fell as well. CAPTCHAs were solved with 100% accuracy. Passwords fell to spray attacks. And here's the uncomfortable part: the agents got around model safety guardrails by framing the work as authorized penetration testing. From the model's side, there was essentially no way to distinguish legitimate security work from an actual intrusion.

One caveat is worth holding, though. Dream itself, and the researchers who've reviewed this, qualify the word "autonomous." Significant human effort went into designing and tuning the framework, and the same caveat applied to the autonomous cyber espionage case Anthropic disclosed in 2025. The precise description isn't "fully autonomous attack" — it's an attack whose execution phase was autonomous. The human is still the architect.

What this means for each camp

For attackers, the gain is economies of scale. The bottleneck in state-grade cyber operations has always been skilled people — headcount effectively capped how many campaigns could run at once. Autonomous execution removes that ceiling. The same team can now aim at ten times the targets simultaneously. And this framework was assembled from open-source parts, so the cost barrier is low too.

For defenders, the problem is speed. Twelve waves, 21 systems mapped, 36+ endpoints enumerated, all in four days. That's faster than a human reviewing logs and deciding on a response. Defense has to move into automated detection and response as well. "AI versus AI" stops being a marketing line and becomes an operational fact.

For governments and regulators, the target list is the message. Including a nuclear safety authority and energy companies invites the reading that this went beyond intelligence collection into infrastructure reconnaissance. No physical impact was reported, but knowing the structure of generation and regulatory systems is a strategic asset in itself.

For AI model providers, the position is awkward. This attack didn't route around frontier model API safeguards — it was assembled from open-source agent frameworks. So no amount of API-side guardrail work closes this path. OpenAI's own decision to hold back certain model deployments over "critical cyber capability" sits on the same concern.

For ordinary companies, the practical lesson isn't about AI at all. Unauthenticated API endpoints, reused passwords, configuration data exposed on a portal page. Every weakness this campaign exploited is a well-known one. What changed is only how fast those weaknesses get found.

We've had these warnings before — the responses split

This isn't the first alarm about AI-automated offense, and how the earlier ones resolved is useful context.

The most direct precedent is the autonomous cyber espionage case Anthropic disclosed in 2025 — a largely automated espionage operation run through its own models. It rattled the industry, and afterward frontier labs started putting cyber capability evaluations into their pre-deployment checklists. What made that work was observability: the model provider could see what was happening on its own API. If you can see it, you can block it.

This case is the inverse. Run open-source agents on your own servers and that observation point disappears. That's not a new problem so much as the latest edition of an old open-source security dilemma. Publish the tools and defenders get stronger — but so do attackers. Penetration testing frameworks like Metasploit have argued about this for decades. The settled answer there was not to suppress publication but to raise defensive speed.

There's a failure pattern worth noting too. After a major breach, organizations reliably go buy a new security product. Post-mortems just as reliably find that most breaches came from failed hygiene rather than missing technology. Same here: 36 unauthenticated APIs cannot be solved by any AI defense product. That's just something you fix.

How defenders counter

Automated detection and response is the first axis. Attack speed now exceeds the human decision cycle, so response has to move inside that cycle. Anomalous authentication patterns, sudden API call spikes, large-scale enumeration in compressed timeframes — those signals need to trigger blocks without waiting for a person.

Attack surface management is the second. This campaign started from configuration data scraped off a single government portal. Regularly auditing what your public pages leak isn't optional anymore. The attacking side automated that audit; the defending side has to match it.

Identity and authentication is the third. Eighty-five accounts falling means password-based auth was still live. Spray attacks collapse in environments where multi-factor is enforced. And CAPTCHAs being solved at 100% accuracy confirms what many already argued — CAPTCHA is not a security control.

Information sharing is the fourth. This operation surfaced because of an attacker mistake — an exposed archive — not because a defender detected it. That's a sizable gap in detection capability. Fast cross-industry and cross-border sharing of similar patterns is the practical way to narrow it.

The AI industry's own response hasn't taken shape yet. There's discussion of building safeguards into open-source agent frameworks, but when the code is public, safeguards get removed. The center of gravity will likely shift from restricting distribution toward improving detection.

So what actually changes

If you run security, this week's job is concrete. Pull the list of externally exposed API endpoints and check each one for authentication. Then verify multi-factor is enforced across accounts. Those are precisely the two places this campaign got through.

If you run IT, the issue is log time resolution. Twelve waves passed in four days. If your review cadence is daily, you find out after it's over. Getting detection cycles below attack cycles is the whole game.

If you're an executive, the message is that the risk calculation moved. "Are we important enough to be a nation-state target?" used to be a reasonable question. When execution costs fall through automation, the selection criterion shifts from "is this important" to "is this easy."

If you work in policy, a new gray zone just opened. Frontier model APIs can be regulated and monitored; open-source agents running on private servers cannot. How to handle that gap is going to be a central question in AI safety regulation.

If you're just a citizen, the nature of the leaked data is what matters. Those 2,500 personnel records contain civil servants' personal information. Data like that is usually less valuable for direct sale than as raw material for follow-on targeting — sophisticated phishing and impersonation. Expect more messages claiming to come from government offices.

🥄 Three Things You're Probably Wondering

— Did an AI really do all of this by itself? No. Execution was autonomous, but designing and tuning the framework took substantial skilled human work — Dream explicitly says careful task-specific adjustment was required. The accurate framing is "human-designed, AI-executed." The real concern is that autonomous execution multiplies how many campaigns one person can run.

— Was this ordered by the Chinese government? Dream didn't say that. It reported traces of a Chinese-language operator in the operational documents and declined to attribute at the state level. Chinese-language artifacts could point to a state body, a contractor, or even be planted misdirection. Attribution requires a great deal more evidence.

— Could my company get hit like this? The odds are higher than they were. But the weaknesses this campaign exploited weren't exotic — unauthenticated APIs, guessable passwords, exposed configuration. All old problems. Organizations with solid hygiene hold up much better against automated attacks too. Check the basics before you buy a product.

References

Numbers are as of publication and may change.