Near-Autonomous AI Agents Breach Taiwan's Government and Nuclear Safety Regulator in Four Days

Taiwanese government agencies including the justice ministry, the nuclear safety regulator, government email systems, government IT supply chain vendors, and seven or more energy sector companies

Israeli security firm Dream published forensics on August 12, 2026 covering a four-day intrusion campaign that ran July 1 to 4, 2026. A multi-agent system deployed up to eight sub-agents across 12 attack waves, mapped 21 government systems, cracked 85 government user accounts through repeated password spraying, and exfiltrated 2,564 personnel records, seven SSO client secrets, and six internal database credentials, including a 160MB archive of 1,395 files. On one target the agents enumerated more than 36 API endpoints spanning account management, many of them completely unauthenticated. Having finished the assigned government targets, the system expanded on its own to the nuclear safety agency, supply chain vendors, and energy companies. Taiwan's Ministry of Digital Affairs confirmed the campaign on August 13 after a Financial Times report, saying its monitoring unit detected the activity in July, that the National Institute for Cyber Security began issuing alerts on July 20, and that affected agencies had completed their responses. The ministry described a hybrid approach combining conventional operations with AI agents including OpenClaw, and did not state where the attacks originated. Dream did not attribute to a group, but noted operational documentation written in simplified Chinese

The framework was assembled from freely downloadable parts: Hermes, released by Nous Research in February 2026, and OpenClaw, released in November 2025. Operators bypassed model guardrails by framing the intrusion as an authorized penetration test, so no exploit code had to be written and no jailbreak was needed. The reported first near-autonomous AI attack on a government, and a demonstration that the capability now costs a download and a plausible cover story