Chinese Hackers Use AI Agents in First Autonomous Cyberattack on Taiwan, Stealing 2,500+ Records

Suspected China-linked hackers used AI to run the first-ever end-to-end autonomous cyberattack on Taiwan's government, Israeli firm says -- open-source-built tool continuously devised effective hack strategies in real-time

Experts warn that every government should now assume it is under permanent automated assault. Hackers with suspected links to China used publicly available AI tools to carry out what researchers describe as the first observed end-to-end autonomous cyberattack against a government target, compromising at least 85 user accounts and stealing more than 2,500 personnel records from Taiwanese government systems, according to an August 12 Financial Times report, citing researchers at Israeli cybersecurity company Dream. The researchers say the attackers assembled an autonomous hacking platform using open-source AI-agent frameworks, enabling multiple agents to simultaneously map networks, research vulnerabilities, attempt intrusions, and adapt tactics when an attack path failed. The campaign reportedly ran for four days at the beginning of July and at times deployed as many as eight autonomous agents in parallel. Dream said the system mapped 21 government systems before compromising user accounts and extracting personnel information. The attackers subsequently expanded their activity to Taiwan's nuclear safety agency, at least seven energy companies, government suppliers, and other government systems. Dream says it found the evidence inside a 160-megabyte (160MB) online archive that surfaced during its broader tracking of cyberthreat actors. The archive reportedly held 1,395 files showing that the tool was built on two open-source AI agent systems -- Hermes and OpenClaw -- both of which can be downloaded freely and are designed to let large language models carry out multi-step tasks on their own. Researchers could not determine which underlying model powered the agents, but the data reportedly showed the model's safeguards had been sidestepped by presenting the intrusion as an authorized penetration test rather than a real attack. Of particular concern is that the toolkit for the hack comprised such easily available systems, neither of which was purpose-built for offense. The operators appear to have assembled a capable autonomous tool out of components any developer can pull down and run. What the researchers describe as the tool's most striking feature was its ability to continuously devise attacks on its own, rather than follow a preprogrammed route. The platform continuously assessed available evidence, ranked possible attack paths, and reprioritized them as circumstances changed. When one technique failed, the tool tasked another agent with searching the internet for information and developing an alternative approach. Dream stopped short of attributing the campaign to a specific hacking group or country. However, the researchers said the operators' internal communications were written in Simplified Chinese, suggesting what they called a high probability that the operator was connected to China. The company also declined to name the victim, citing policy, but confirmed that it had notified a country in the "Asia-Pacific" region. Also, the data pulled from the target was in Traditional Chinese -- a script used on government sites in Taiwan, Hong Kong, and Macau. Financial Times said a person with knowledge of the incident identified the target as Taiwan. The incident highlights a growing concern within both the cybersecurity and AI industries over what the latest AI models can do autonomously. Anthropic, OpenAI, and Meta have reported instances of new AI models launching unexpected cyberattacks during internal testing, an infamous example being the recent OpenAI agent's attack on Hugging Face. In another instance, OpenClaw wiped the inbox of Meta's AI Alignment director despite repeated commands to stop Researchers have warned that AI agents are making it increasingly easy to automate portions of cyberattacks that previously required skilled human operators, another deadly feature in the era of AI hacking. Dream's chief strategy officer, Amir Becker, warned that the arrival of such tooling used in the Taiwan attack means every government should now assume it is under permanent automated assault. The risk is stark for Taiwan, which was already facing a staggering volume of cyberattacks before agents entered the picture. The island's National Security Bureau reported in January that it faced an average of 2.6 million Chinese cyberattacks per day in 2025, up 6 percent from the previous year. Beijing claims Taiwan as part of its territory and has threatened to use force if necessary to bring the island under its control. According to the Financial Times, Taiwan's Ministry of Digital Affairs declined to comment on the specific incident, citing confidentiality. However, a ministry spokesperson acknowledged that the integration of AI has transformed the nature of security incidents. Follow Tom's Hardware on Google News, or add us as a preferred source, to get our latest news, analysis, & reviews in your feeds.

Chinese Hackers Created a 'Near-Autonomous' Attack Using Open-Source AI

In a disturbing sign, Chinese hackers used open-source AI to create a "near-autonomous attack" capable of stealing data from government agencies. The attack was so efficient that it cracked 85 government accounts through password guessing, pilfered thousands of records, and even discovered access vulnerabilities in a government web application, all within about four days, according to Israeli cybersecurity provider Dream. The attack was launched through a hacker-created software framework that harnesses the free and open-source AI agents Hermes and OpenClaw, which can run autonomously on a computer. The framework used at least eight "sub-agents," each dedicated to specific tasks and targets, whether it be vulnerability testing, password-guessing, or "supply chain reconnaissance." Dream also noted that the AI agents overrode their own safety guardrails because the instructions were framed as "authorized penetration testing," which amounts to stress testing by a cybersecurity vendor. The company's security researchers uncovered the threat last month, discovering "the complete operational workspace of an autonomous AI attack framework that had been actively conducting intrusion campaigns against government entities in Asia." Specifically, the attack was carried out against government agencies in Taiwan, according to The Financial Times, citing an unnamed source. The creators of the attack were likely from mainland China since the computer code used simplified Chinese Mandarin in the internal status reports. Curiously, the computer code switched to traditional Chinese Mandarin in the "target-facing" analysis, suggesting the attack was intended for Taiwan, where traditional Chinese Mandarin is used. Dream's investigation found that the attack stole "2,564+ personnel records," along with a complete user database. "The attacker didn't stop at primary targets. It expanded the operation to government IT supply chain vendors, a nuclear safety agency, a government email system, and 7+ energy sector companies -- scanning them all in parallel for misconfigurations, exposed admin interfaces, and exploitable vulnerabilities," the company added. Dream is now warning that the "era of AI-orchestrated" attacks on government infrastructure is here, meaning countries will need to act promptly to secure their systems. "The cost of running a competent attack has collapsed, but the cost of defending against one has not," it added. The top AI companies have been offering their latest models to the tech industry and the US government to shore up their defenses, including discovering and patching new flaws. But in a bit of irony, the same cutting-edge models have shown they can go rogue and inadvertently hack other systems, posing a potential risk to any company or government agency that adopts them. OpenAI has paused the release of its upcoming Astra model due to its gaining "critical cyber capabilities."

'Near-autonomous' AI agents attack Taiwan's nuclear safety agency

Suspected Chinese cyber operatives used publicly available AI tools to compromise Taiwanese government systems before expanding the attack to its nuclear safety agency, supply-chain vendors, and at least seven energy companies in what security researchers called a "near-autonomous attack." Over the first four days of July, AI agents compromised 85 government user accounts and extracted more than 2,500 personnel records, according to Dream, an Israeli cybersecurity firm. Researchers uncovered evidence of the attack in a 160 MB online archive containing 1,395 files documenting the operation. Dream, in research published on Wednesday, detailed the intrusions and said that the suspected Chinese hackers hit "government entities in Asia" - but declined to say which government had been attacked. A person familiar with the attack confirmed to The Register that Taiwan was the target. The Financial Times first reported on Dream's research and identified Taiwan. While the security firm doesn't attribute the agentic attack to the Chinese government or a specific hacking group, the operational documentation "points to a Chinese-language operator," the researchers said. According to Dream, the attack framework, built on open source Hermes and OpenClaw AI agents, deployed up to eight sub-agents, each assigned to its own targets and attack techniques, across 12 "attack waves" between July 1 and July 4. First, the agents mapped the entire government ecosystem, extracting embedded URLs, API endpoints, OAuth client IDs, and Keycloak configuration objects from a single government portal. This portal allowed the agents to identify 21 connected government systems and every supported authentication flow. "On one target alone, it discovered 36+ API endpoints spanning account management, user data retrieval, file upload, and administrative functions - many completely unauthenticated," the Dream threat researchers wrote. "Critically, it found that one of the systems exposed its entire user database without any authentication - thousands of employee records including names, departments, and SSO account IDs." Multiple entry points After mapping the government's attack surface, the agents found multiple entry points including three hidden API endpoints that accepted any request body and returned a valid authenticated session without requiring user credentials. Using employee usernames harvested from an unauthenticated API, the agents broke into a government department's office automation portal, solving its CAPTCHAs with 100 percent accuracy. The agents also tested predictable password patterns based on each employee's ID, and cracked 85 accounts across multiple password-spray rounds. Eighty-four of the 85 cracked accounts successfully authenticated to the department's internal information system, giving the attackers access to internal dashboards, equipment management interfaces, and personnel statistics pages. In total, the illicit access allowed the agents to exfiltrate a ton of government information, including more than 2,564 personnel records, a full JSON export of all department system users, seven SSO client secrets, six internal database credentials across MSSQL, Oracle, and Sybase, and internal network IP ranges. But wait, there's more And then, the agents pivoted to the Taiwanese government's supply chain. "It expanded the operation to government IT supply chain vendors, a nuclear safety agency, a government email system, and 7+ energy sector companies - scanning them all in parallel for misconfigurations, exposed admin interfaces, and exploitable vulnerabilities," the researchers wrote. Notably, the attack framework implemented what the AI tools called "learning cycles." These are autonomous sessions where the models search vulnerability databases, GitHub repositories, and other security research for specific techniques, CVEs, and common weaknesses to exploit in the targeted government's infrastructure. Additionally, when the AI framework made a mistake, it "self-corrected," according to Dream, catching errors and fixing them through its own verification process. This near-autonomous attack comes as frontier model makers OpenAI, Anthropic, and Meta all admitted that their agents went rogue, escaped from their training environments, and autonomously hacked other organizations and people. OpenAI technical staffer Michael Dalton, in a Black Hat briefing last week about the Hugging Face attack, said "AI orchestrated, fully automated offensive attacks are real now." "In the near future, we should expect that threat actors will intentionally deploy, optimize, weaponize, and use offensive agent collectives in the manner that you have just described here," he added. It appears that the future is now. ®

Taiwan says it was targeted last month in AI-driven hacking campaign

TAIPEI/WASHINGTON, Aug 13 (Reuters) - Taiwan detected AI-assisted cyberattacks on government agencies last month coming from overseas but the affected bodies successfully "handled" the incident, the Ministry of Digital Affairs said on Thursday. Taiwan has in recent years complained about what it sees as China's "hybrid warfare" -- from daily military drills near the island to disinformation campaigns and cyberattacks -- as Beijing ramps up military and political pressure on the democratically governed island to force Taipei to accept its claims of sovereignty. Chinese cyberattacks on Taiwan's key infrastructure from hospitals to banks rose 6% in 2025 from the ⁠previous year to an average of 2.63 million attacks a day, the island's National Security Bureau said in January, adding some of the hacks were synchronised with military drills in "hybrid threats" to paralyse the island. In a statement, the Ministry of Digital Affairs said its cybersecurity monitoring units detected the "abnormal attack" targeting government agencies in July, and beginning July 20, its National Institute of Cyber Security issued a series of warning alerts while it investigated. The investigation results showed the attacks displayed clear characteristics of an "overseas source", with hackers employing a hybrid approach that combined manual operations with AI agent-assisted attacks, such as Open Claw, it said. "The relevant attack sources, methods, and scope of impact have all been fully investigated, and ⁠the affected units have successively completed their handling," the ministry added. In response to this new type of AI-derived cybersecurity threat, the government has established protective guidelines and strengthened system monitoring across agencies to block attacks early, it said. The statement did not mention China, and China's Taiwan Affairs Office did not immediately respond to a request for comment on the attack. ISRAELI FIRM'S REPORT Taiwan's statement came ⁠a day after the Israeli cybersecurity company Dream said in a blog post that it had uncovered an AI-driven hacking campaign that stole credentials and other data from an unnamed government in Asia. Dream said a team of AI agents worked together to extract ⁠scores of passwords from unidentified officials, steal personnel records from Taiwan's justice ministry, and scan its nuclear safety agency for vulnerabilities over the course of four days. Dream, which said it was able to reconstruct the hacking campaign after ⁠recovering the agents' "complete operational workspace," declined to share the data or name the government when approached by Reuters, but the Financial Times, which was the first media outlet briefed on Dream's findings, identified the target agencies as Taiwanese. Reporting by Ben Blanchard and Raphael Satter; Additional reporting by Ryan Woo in Beijing; Editing by Kate Mayberry Our Standards: The Thomson Reuters Trust Principles., opens new tab * Suggested Topics: * Artificial Intelligence Ben Blanchard Thomson Reuters Ben joined Reuters as a company news reporter in Shanghai in 2003 before moving to Beijing in 2005 to cover Chinese politics and diplomacy. In 2019 Ben was appointed the Taiwan bureau chief covering everything from elections and entertainment to semiconductors. Raphael Satter Thomson Reuters Reporter covering cybersecurity, surveillance, and disinformation for Reuters. Work has included investigations into state-sponsored espionage, deepfake-driven propaganda, and mercenary hacking.

China-linked hackers hit Taiwan in unprecedented 'autonomous' AI cyber attack

AI agents ran simultaneous reconnaissance and break-ins in display of new phase of cyberwarfare Suspected Chinese hackers used publicly available AI tools to compromise government websites in Taiwan in a first-of-a-kind breach, highlighting how artificial intelligence is transforming cyber warfare. The attackers used open-source AI agents to build an autonomous hacking tool that behaved like a co-ordinated cyber team, according to researchers at Dream, an Israeli AI company that first identified the intrusion. Over four days at the start of July, the tool simultaneously deployed up to eight autonomous agents that mapped 21 government systems, researched vulnerabilities and changed tactics when blocked. The tool compromised at least 85 government user accounts, extracting more than 2,500 personnel records before expanding the attack to Taiwan's nuclear safety agency and at least seven energy companies, the research showed. The discovery comes as the AI and cyber industries wrestle with the ability of the latest models to identify and exploit software vulnerabilities. Anthropic, OpenAI and Meta have also reported new AI models launching unexpected cyber attacks during testing. Dream's chief strategy officer, Amir Becker, who previously headed cyber operations for Israel's elite signals intelligence Unit 8200, said he had never before seen such an "end-to-end autonomous attack" on a government target. The advent of AI tools meant governments must now assume they are under permanent cyber attack, he added, saying: "This must be the basic assumption of every government around the globe." A person with knowledge of the attack said the target was Taiwan. Dream declined to confirm the identity of the targeted government, citing company policy, but said it had informed a country in "Asia-Pacific" of the breach. Dream has not attributed the attack to a specific group, but researchers said the use of Simplified Chinese in internal communications linked to the hack meant there was a high probability the operator was connected to China. In contrast, the data recovered from the target was written in Traditional Chinese, as is common only on government websites in Taiwan, Hong Kong and Macau. A spokesperson at Taiwan's Ministry of Digital Affairs declined to comment on the hack, citing confidentiality issues. They added that all incidents "involving government agencies or critical infrastructure will be handled according to established reporting and response procedures". "Hacker attack methods have become increasingly diverse, and in recent years, the integration of AI technology has further transformed the nature of cyber security incidents," the spokesperson said. " AI agents have brought new dual challenges to network security defence: the attacks are automated, and AI agents themselves become new vulnerabilities." Chinese authorities did not respond to requests for comment. Dream was founded in 2023 by Israeli cyber entrepreneur Shalev Hulio and Austria's 39-year-old former chancellor Sebastian Kurz. Hulio rose to prominence in the 2010s as a co-founder of NSO Group, the controversial cyber-surveillance group that was blacklisted by the US in 2021 over the alleged use of its Pegasus software by certain governments to spy on journalists and opposition figures. Headquartered in Tel Aviv, Dream describes itself as a national sovereign AI and cyberdefence company. It was valued at $1.1bn in February 2025 after a $100mn funding round led by Bain Capital. Dream's researchers said they found evidence of the July cyber attack in a 160MB online archive identified during the company's general investigations into the evolving activities of cyberthreat actors. The archive contained 1,395 files showing the hacking tool used two open-source AI agent systems, Hermes and OpenClaw, which can be downloaded and enable AI models to carry out tasks autonomously. The researchers could not identify which AI model was used to power the agents. However, the data showed that the underlying model's safeguards had been bypassed by presenting the hacking activity as an authorised exercise to test for system vulnerabilities. Last November, Anthropic said it suspected Chinese state-sponsored hackers had manipulated its Claude tool to attempt to hack 30 international companies and government agencies, albeit with limited success. The most striking feature of the July attack was how the tool continuously ranked and reprioritised possible attack paths based on available evidence, Dream said. When one attack path failed, the tool deployed another agent to scour the internet for information and devise a new approach as a human hacker would. In its January report, Taiwan's National Security Bureau said the island faced an average of 2.6mn Chinese cyber attacks a day in 2025, up 6 per cent from a year earlier. Beijing claims Taiwan as part of its territory and threatens to annex it by force if Taipei refuses indefinitely to submit to its control.

Taiwan says AI agents helped hack its government in four days

A July campaign against Taiwanese agencies blended manual hacking with AI agents like "Open Claw", stealing scores of passwords and raiding a ministry in the time a human crew would need to warm up. Taiwan says it spent part of last month fending off a hacking campaign that leaned on artificial intelligence to do the heavy lifting. The island's Ministry of Digital Affairs, through its National Institute of Cyber Security, disclosed that government agencies were targeted in July, with alerts going out from around 20 July. What makes the episode notable is not the break-in itself but the method. According to the ministry, the campaign blended old-fashioned manual hacking with the assistance of AI agents, software that can be pointed at a target and left to reason and act largely on its own. One such agent, "Open Claw", was cited as an example of the agent-assisted approach. The result was speed. Over roughly four days the attackers extracted "scores of passwords", stole personnel records from the justice ministry, and probed a nuclear-safety agency for vulnerabilities. That kind of breadth once demanded a skilled human team working for weeks, which is partly why the question of who is liable when a rogue AI agent hacks a company has stopped being hypothetical. The targets were government bodies, and the reported activity ranged from credential theft to broader data extraction. The ministry said the affected units had "successively completed their handling", and insisted that "the relevant attack sources, methods, and scope of impact have all been fully investigated". Officials described the source as overseas but stopped short of naming a culprit, and no threat-actor group has been identified. The disclosure nonetheless lands amid the persistent tensions between Taiwan and China, and it is not hard to read a subtext into the timing, even if the evidence made public does not spell one out. The wider context arrived from outside Taiwan. The disclosure follows a report by the cybersecurity firm Dream describing an AI-driven campaign against an unnamed Asian government, later identified as Taiwan by the Financial Times. That is roughly the sequence in which these stories now tend to surface: a private firm spots the pattern, and the government confirms it afterwards. For all the talk of autonomous machines, the humans have not left the building. "There's still a human in there somewhere," one security researcher cautioned of the campaign. "It's not totally 100% autonomous." The distinction matters, because the AI here is an accelerant rather than a replacement, and accelerants are the sort of thing defenders lose sleep over. What that acceleration lowers is the barrier to entry. An AI agent recently faked identities to plant malware, and the tools involved are cheap, widely available, and improving fast, which quietly hands the resources of a state to almost anyone willing to run them. The vulnerabilities cut both ways, mind. Researchers have shown that these agents can be turned against their own operators, in one case tricking an OpenClaw agent into leaking AWS keys and customer data with nothing more than a phishing email. An attacker's clever assistant is also a fresh attack surface. Taiwan is, in many respects, the obvious place to watch this play out first. It sits at the sharp end of geopolitical pressure, runs a dense and heavily digitised public sector, and has long served as a proving ground for cyber-techniques that later surface elsewhere. The compression of time is the part worth dwelling on. What used to be measured in the weeks a human crew needed to move laterally through a network can now, on this evidence, be squeezed into a long weekend, which rewrites the arithmetic for everyone tasked with defending one. Taiwan says it has since tightened monitoring and issued protective guidance across its agencies. Whether that proves enough is another matter, because if a handful of AI agents can rifle through government systems in four days, the next campaign is unlikely to wait politely for the defenders to catch up.

World-first autonomous 'end-to-end' AI attack against Taiwan tied to Chinese hackers -- and the scariest part is that it was fully open source

* China launched a fully autonomous vulnerability hunting attack against Taiwan * The attack leveraged eight open-source AI models to hunt for new attack vectors * The attack hit Taiwan government accounts, personnel records, the nuclear safety agency, and more A first-of-its-kind cyberattack using autonomous AI has been spotted attacking Taiwan, and it compromised 85 government accounts and stole over 2,500 personnel records before moving on to hit the country's nuclear safety agency and at least seven energy companies. The attack used eight open-source AI models to build a hacking program that was able to independently conduct reconnaissance and intrusion, and was able to chain vulnerabilities and change tactics whenever it was blocked. The intrusion took place over the course of four days, and was first exposed by The Financial Times on August 12, 2026. The FT article covered research performed by Dream, an Israeli AI and cyberdefense company that first identified the breach. Autonomous AI attack The attack was first uncovered during routine monitoring of cyber criminal activity. Dream found a 160MB online archive of 1,395 files. Further examination of the files revealed that the attack relied on Hermes and OpenClaw - two open-source AI agents. As is typical of attacks relying on AI models, the hackers had framed the context of the intrusion as a routine cyber readiness test in order to bypass the built-in guardrails of the AI models. The attack used multiple agents to hunt for new vulnerabilities and access points across the internet, providing the tool with multiple attack paths to take if one failed to gain entry. AI agents have been quickly integrated into the attacks of cybercriminal organizations and state-sponsored threat actors alike, enhancing their abilities to launch highly complex attacks at scale. "This must be the basic assumption of every government around the globe," said Amir Becker, Dream's chief strategy officer. Dream did not tie the attack to any specific cybercriminal group, nor did it confirm the target of the attack, but said it had alerted a government in the "Asia-Pacific." Documentation within the recovered archive contained Simplified Chinese, which is the official written language used in mainland China. The archive also contained data collected from the targets, which was written in Traditional Chinese. This form of written Chinese is widely used in Taiwan, Hong Kong, and Macau. Taiwan's Ministry of Digital Affairs has refused to comment on the breach, and the Chinese authorities have not responded to requests for comment. China has long considered Taiwan to be a part of mainland China. Taiwan declared its independence following the end of the Chinese Civil War in 1949. A report from Taiwan's National Security Bureau earlier this year revealed that the country was subject to 2.5 million Chinese cyberattacks per day in 2025. Expert perspective on autonomous AI attack Collin Hogue-Spears, senior director of solution management at Black Duck: The agents ran the intrusion end to end and invented nothing new to run it with. Familiar identity and API failures opened every confirmed path into Taiwan's systems. Dream Research Labs documented up to eight subagents working concurrently across twelve waves, ranking attack paths, redirecting when a technique failed, and researching alternatives online before trying again. What they found was exposed development endpoints, an API accepting authentication tokens with the signature check disabled, unauthenticated data APIs, and passwords built from employee ID numbers. The framework also ran its own AI static analysis hunting unknown flaws, but Dream says it worked against two public single sign-on SDK sample projects, and none of those findings produced a confirmed exploit on the live systems. No zero-day appears anywhere in the report, but a nuclear safety regulator does. In conventional web and identity logs, this reads as a security scan. The distinguishing signal is the sequence across systems, not any single request. The tell is not the request. It is what the same account does next, somewhere else. Conventional scanners have tested thousands of endpoints at machine speed for twenty years, so raw coverage is not the change here. What Dream Research Labs describes is chaining: password spraying, then fresh SSO sessions, then access to routes an account had never touched, then the same suspected weakness retested until it held, then one identity surfacing across several connected applications. Simplified Chinese in the operator's notes is one signal. Traditional Chinese in the stolen files is just Taiwan. Dream rested its China assessment on a code-switching observation, and only half of it points at the attacker. Per Chinese-language coverage of the report, Simplified characters appeared in the operators' internal communications and Traditional characters appeared in the exfiltrated data. The first describes the operator's working language. The second describes the victim, because that is what Taiwanese government files look like [Traditional Characters]. The evidence therefore supports a Chinese Mainland-language operator against a Taiwanese target, with a target profile consistent with mainland collection priorities. It does not name a group or establish state direction. The report also publishes no indicators, no hashes, and no victim confirmation; it does not identify the model, and its executive summary claims installed backdoors while its own attack chain says authentication blocked the web shell. Security leaders must reject unsigned authentication tokens and prohibit the alg:none setting outright, and separately require reauthentication or multi-factor at any single sign-on boundary into a sensitive system. Dream describes two independent identity failures in Taiwan, and closing one leaves the other open. Provider guardrails cannot compensate for a password-only SSO bridge. They must also monitor route diversity per source, per session, per account, and per device rather than by request rate alone, because a distributed set of agents spreads requests across addresses and sessions that no single volume threshold catches. If your detection assumes one attacker at one address working one path at a time, you have modeled the wrong shape. Your thresholds were built for one attacker on one path. This was eight, in parallel. And they must ask two questions of any AI attack disclosure before acting on it: which model ran the operation, and what can we hunt on tomorrow morning?" Via United24 Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.

Taiwan says it was hit by 'abnormal' AI-assisted cyber-attack

Taiwan's statement comes a day after reports that suspected China-linked hackers had carried out a first-of-a-kind breach Taiwan says it detected AI-assisted cyber-attacks on government agencies that came from overseas last month, a new kind of threat that has been reported as "first-of-a-kind breach". The Ministry of Digital Affairs (MDA) said its cybersecurity monitoring units detected the "abnormal attack" targeting government agencies, which began on 20 July. The National Institute of Cyber Security issued a series of warning alerts while it investigated. The Financial Times quoted Dream - an Israeli AI company that detected the intrusion - as saying the attackers used open-source AI agents to build an autonomous hacking tool that behaved like a coordinated cyber team, describing it as a first-of-a-kind breach. Dream was reported as saying that the tool compromised "at least 85 government user accounts, extracting more than 2,500 personnel records before expanding the attack to Taiwan's nuclear safety agency and at least seven energy companies". Taiwan has in recent years complained about what it sees as China's "hybrid warfare" - from daily military drills near the island to disinformation campaigns and cyber-attacks - as Beijing ramps up military and political pressure ⁠on the democratically governed island to force Taipei to accept its claims of sovereignty. Though Taiwanese officials did not direct accusations at China, the FT on Wednesday reported that China-linked hackers were suspected. Dream did not attribute the attack to a specific group, but said the use of Simplified Chinese in internal communications linked to the hack meant there was a high probability the operator was connected to China, the FT reported. Chinese cyber-attacks on Taiwan's key infrastructure, from hospitals to banks, rose 6% in 2025 from the previous year to an average of 2.63m attacks a ⁠day, the island's National Security Bureau said in January, adding some hacks were synchronised with military drills in "hybrid threats" to paralyse the island. The investigation into the AI-assisted attack said it showed clear characteristics of an "overseas source", with hackers employing a hybrid approach that combined manual operations with AI agent-assisted attacks, such as Open Claw, the MDA said. "The relevant attack sources, methods, and scope of impact have all been fully investigated, and the affected units have successively completed their handling," the ministry added. In response to this new type of threat, the government has established protective guidelines and strengthened system monitoring to block attacks early, it said. The statement did not mention China, and China's Taiwan Affairs Office did not immediately respond to a request for comment on the attack. Taiwan's MDA and Chinese authorities did not comment on the earlier FT report. The threat of AI-assisted hacking campaigns has been growing for years but ramped up dramatically over the past few months after top AI labs released models, such as Anthropic's Mythos, which can rapidly conduct reconnaissance, identify vulnerabilities, and take advantage of them. Cris Thomas, a researcher who works as a security advocate at the code security company Semgrep, said the spy campaign was an illustration of just how quickly AI-assisted hackers could hit their mark. Thomas cautioned against exaggerating the power of AI agents, however. "There's still a human in there somewhere. Somebody had to choose who to attack, had to establish an objective and give it a directive," he said. "It's not totally 100% autonomous. There was a capable operator in charge that did that." Reuters contributed to this report

Taiwan says AI agents used in cyberattacks targeting island

Taipei (AFP) - Overseas hackers used artificial intelligence agents to help carry out a wave of cyberattacks targeting Taiwanese government agencies in July, the island's digital affairs ministry said Thursday. Taiwan has previously blamed Chinese hackers for carrying out most of the millions of cyberattacks affecting the island democracy on a daily basis, but did not identify a particular country in this latest incident. China claims Taiwan is part of its territory and has intensified military, political and diplomatic pressure on the island in recent years. Taipei also accuses Beijing of using a range of "greyzone" methods -- tactics that fall short of an act of war -- including cyberattacks to harass the island. The cyberattacks began in July and the "affected agencies have successively completed the response measures", the Ministry of Digital Affairs said in a statement, without providing further details on the scale, damage or targets of the attacks. Hackers used a "hybrid model" that combined AI agents, such as the open-source AI agent platform OpenClaw, to assist in the attacks, the ministry said. "AI agents can rapidly chain together multiple attack techniques and use secondary systems -- such as backup and testing systems -- as jumping-off points, giving the attacks the characteristics of high speed, low cost, and large scale." Chinese tech giants seeking to take advantage of the interest in OpenClaw have been offering simplified installation and affordable coding plans to help users host its agents on cloud servers. The digital affairs ministry's statement was in response to a Financial Times article this week that identified Taiwan as the target of an autonomous AI attack by suspected Chinese hackers. The FT, citing researchers at Israeli AI company Dream, said hackers had used open-source AI agents to build an autonomous tool to carry out the attack. The tool deployed up to eight autonomous agents that mapped 21 government systems, explored vulnerabilities and changed tactics when blocked, the FT said, describing the attack as a first of its kind. While AI cyberattacks are "not a new thing", this was "the first time it has been revealed that multiple AI agents were used to carry out a cyberattack," said Kenny Huang, chairman of Taiwan Network Information Center, an internet services company. Several countries, notably the United States, have voiced alarm in recent years at what they say is hacking activity backed by Beijing targeting their governments, militaries and businesses. China has denied the allegations, previously insisting it opposes and cracks down on all forms of cyberattacks.

Taiwan says it was targeted last month in AI-driven hacking campaign

Taiwan detected AI-assisted cyberattacks on government agencies last month coming from overseas but the affected bodies successfully "handled" the incident, the Ministry of Digital Affairs said Thursday. Taiwan has in recent years complained about what it sees as China's "hybrid warfare" -- from daily military drills near the island to disinformation campaigns and cyberattacks -- as Beijing ramps up military and political pressure on the democratically governed island to force Taipei to accept its claims of sovereignty. Chinese cyberattacks on Taiwan's key infrastructure from hospitals to banks rose 6% in 2025 from the previous year to an average of 2.63 million attacks a day, the island's National Security Bureau said in January, adding that some of the hacks were synchronized with military drills in "hybrid threats" to paralyze the island. In a statement, the Ministry of Digital Affairs said its cybersecurity monitoring units detected the "abnormal attack" targeting government agencies in July, and beginning July 20, its National Institute of Cyber Security issued a series of warning alerts while it investigated. The investigation results showed the attacks displayed clear characteristics of an "overseas source," with hackers employing a hybrid approach that combined manual operations with assistance from AI agents such as OpenClaw, it said. "The relevant attack sources, methods, and scope of impact have all been fully investigated, and the affected units have successively completed their handling," the ministry added. In response to this new type of AI-derived cybersecurity threat, the government has established protective guidelines and strengthened system monitoring across agencies to block attacks early, it said. The statement did not mention China, and China's Taiwan Affairs Office did not immediately respond to a request for comment on the attack. Taiwan's statement came a day after the Israeli cybersecurity company Dream said in a blog post that it had uncovered an AI-driven hacking campaign that stole credentials and other data from an unnamed government in Asia. Dream said a team of AI agents worked together to extract scores of passwords from unidentified officials, steal personnel records from Taiwan's justice ministry, and scan its nuclear safety agency for vulnerabilities over the course of four days. Dream, which said it was able to reconstruct the hacking campaign after recovering the agents' "complete operational workspace," declined to share the data or name the government when approached by Reuters, but the Financial Times, which was the first media outlet briefed on Dream's findings, identified the target agencies as Taiwanese. The threat of AI-assisted hacking campaigns has been growing for years but ramped up dramatically over the past few months after top AI labs released models, such as Anthropic's Mythos, that can rapidly conduct reconnaissance, identify vulnerabilities and take advantage of them. Cris Thomas, a researcher who works as a security advocate at the code security company Semgrep, said the spy campaign was an illustration of just how quickly AI-assisted hackers could hit their mark. Thomas cautioned against exaggerating the power of AI agents, however. "There's still a human in there somewhere. Somebody had to choose who to attack, had to establish an objective and give it a directive. It's not totally 100% autonomous. There was a capable operator in charge that did that," he added.

Taiwan Says It Was Targeted Last Month in AI-Driven Hacking Campaign

(Corrects dateline to Washington, not New York) By Ben Blanchard and ⁠Raphael ⁠Satter TAIPEI/WASHINGTON, Aug 13 (Reuters) - Taiwan detected AI-assisted ⁠cyberattacks on government agencies last month coming from overseas but the affected bodies successfully "handled" the incident, the Ministry of Digital Affairs said on Thursday. Taiwan has in recent years complained about what it sees as China's "hybrid warfare" -- from daily military drills near the island to disinformation campaigns and cyberattacks -- as Beijing ramps up military and political pressure on ⁠the democratically governed ⁠island to force Taipei to accept its claims of sovereignty. Chinese cyberattacks on Taiwan's key infrastructure from hospitals to banks rose 6% in 2025 from the previous year to an average of 2.63 million attacks a day, the island's National Security Bureau said in January, adding some of the hacks were synchronised with military drills in "hybrid threats" to paralyse the island. In a statement, the Ministry of Digital Affairs said its cybersecurity ⁠monitoring units ⁠detected the "abnormal attack" targeting government ⁠agencies in July, and beginning July 20, its National Institute of Cyber Security issued a series of warning alerts while it investigated. The investigation results showed ⁠the attacks displayed clear characteristics of an "overseas source", with hackers employing a hybrid approach that combined manual operations with AI agent-assisted attacks, such as Open Claw, it said. "The relevant attack sources, methods, and scope of impact have all been fully investigated, and the affected units have successively completed their handling," the ministry added. In response to this new ⁠type of AI-derived cybersecurity threat, the government has established protective guidelines and strengthened system monitoring ⁠across agencies to block attacks early, it said. The statement did not mention China, and China's Taiwan Affairs Office did not immediately respond to a request for comment on the attack. ISRAELI FIRM'S REPORT Taiwan's statement came a day after the Israeli cybersecurity company Dream said in a blog post that it had uncovered an AI-driven hacking campaign that stole credentials and other data from an unnamed government in Asia. Dream said a team of AI agents worked together to extract scores of passwords from unidentified officials, steal personnel records from Taiwan's justice ministry, and scan its nuclear safety agency for vulnerabilities ⁠over the course of four days. Dream, which said it was able to reconstruct the hacking campaign after recovering the agents' "complete operational workspace," declined to share the data or name the government when approached by Reuters, but the Financial Times, which was the first media outlet briefed on Dream's findings, identified the target agencies as Taiwanese. (Reporting by Ben Blanchard and Raphael Satter; Additional reporting by Ryan Woo in Beijing; Editing by Kate Mayberry)

Chinese hackers: Taiwan says AI agents used in cyberattacks targeting island

Overseas hackers used artificial intelligence agents to help carry out a wave of cyberattacks targeting Taiwanese government agencies in July, the island's digital affairs ministry said Thursday. The cyberattacks began in July and the "affected agencies have successively completed the response measures", the Ministry of Digital Affairs said in a statement, without providing further details on the scale, damage or targets of the attacks. Overseas hackers used artificial intelligence agents to help carry out a wave of cyberattacks targeting Taiwanese government agencies in July, the island's digital affairs ministry said Thursday. Taiwan has previously blamed Chinese hackers for carrying out most of the millions of cyberattacks affecting the island democracy on a daily basis, but did not identify a particular country in this latest incident. China claims Taiwan is part of its territory and has intensified military, political and diplomatic pressure on the island in recent years. Taipei also accuses Beijing of using a range of "greyzone" methods -- tactics that fall short of an act of war -- including cyberattacks to harass the island. The cyberattacks began in July and the "affected agencies have successively completed the response measures", the Ministry of Digital Affairs said in a statement, without providing further details on the scale, damage or targets of the attacks. Hackers used a "hybrid model" that combined AI agents, such as the open-source AI agent platform OpenClaw, to assist in the attacks, the ministry said. "AI agents can rapidly chain together multiple attack techniques and use secondary systems -- such as backup and testing systems -- as jumping-off points, giving the attacks the characteristics of high speed, low cost, and large scale." Chinese tech giants seeking to take advantage of the interest in OpenClaw have been offering simplified installation and affordable coding plans to help users host its agents on cloud servers. The digital affairs ministry's statement was in response to a Financial Times article this week that identified Taiwan as the target of an autonomous AI attack by suspected Chinese hackers. The FT, citing researchers at Israeli AI company Dream, said hackers had used open-source AI agents to build an autonomous tool to carry out the attack. The tool deployed up to eight autonomous agents that mapped 21 government systems, explored vulnerabilities and changed tactics when blocked, the FT said, describing the attack as a first of its kind. While AI cyberattacks are "not a new thing", this was "the first time it has been revealed that multiple AI agents were used to carry out a cyberattack," said Kenny Huang, chairman of Taiwan Network Information Center, an internet services company. Several countries, notably the United States, have voiced alarm in recent years at what they say is hacking activity backed by Beijing targeting their governments, militaries and businesses. China has denied the allegations, previously insisting it opposes and cracks down on all forms of cyberattacks.

Chinese Hackers Used AI Agents to Hunt Taiwan Government Systems, Breaching 85 Accounts and Stealing Thou

Suspected China-linked hackers used autonomous AI agents to target government systems in Taiwan in what researchers described as a first-of-its-kind cyberattack. The attack compromised at least 85 government user accounts and extracted more than 2,500 personnel records before expanding to Taiwan's nuclear safety agency and at least seven energy companies, the report said. AI Agents Change The Attack The attackers used two open-source AI agent systems, Hermes and OpenClaw, according to Dream's research. The tool continuously ranked and reprioritized possible attack paths based on available information. When one approach failed, another agent searched the internet and developed a new method. Dream Chief Strategy Officer Amir Becker said he had never seen such an "end-to-end autonomous attack" against a government target. The researchers did not identify the AI model powering the agents. The data showed that its safeguards had been bypassed by presenting the hacking activity as an authorized exercise to test system vulnerabilities. Dream did not attribute the attack to a specific group, but researchers found Simplified Chinese in internal communications, suggesting a high probability that the operator was connected to China. Data recovered from the target was written in Traditional Chinese, commonly used on government websites in Taiwan, Hong Kong and Macau. The development comes as Anthropic, OpenAI and Meta Platforms Inc. (NASDAQ:META) have reported unexpected cyberattacks involving AI models during testing. In a related July report, Taiwan's National Security Bureau said the island faced an average of 2.6 million Chinese cyberattacks a day in 2025, up 6% from a year earlier. The Taiwan Ministry of Digital Affairs did not immediately respond to Benzinga's request for comment. Taiwan Tests An Internet Blackout Separately, Taiwan conducted a large-scale civil defense exercise to test how the island would cope if a Chinese attack disrupted communications. Mobile data was deliberately throttled across central Taiwan for 30 minutes on Monday, leaving millions unable to stream videos, share photos or make video calls. Taichung, a city of nearly 3 million people, was among 14 cities and counties included in the internet-disruption exercise, according to a New York Times report published Tuesday. The drill was part of Taiwan's annual civil defense exercise. Sirens sounded at 2:30 p.m., sending people into shelters, homes, shops, malls and train stations. Authorities also warned residents that simulated attacks on communications infrastructure would affect mobile access and advised them to use fixed-line broadband or indoor Wi-Fi. The exercise tested a concern central to Taiwan's defense: how the island would function if its communications with the outside world were degraded. Taiwan relies heavily on subsea telecommunications cables, and officials have said ships linked to China have sabotaged cables connecting Taiwan with some outer islands. The drill took place alongside Taiwan's 10-day annual military exercises. The government sought to prepare the public without causing widespread panic or disrupting business, holding the exercise after the stock exchange closed. The city government later said the drill went well and that emergency hotline and fire brigade calls were not disrupted. Disclaimer: This content was partially produced with the help of AI tools and was reviewed and published by Benzinga editors. Image via Shutterstock Market News and Data brought to you by Benzinga APIs To add Benzinga News as your preferred source on Google, click here.

Taiwan says it was targeted last month in AI-driven hacking campaign

TAIPEI/NEW YORK, Aug 13 (Reuters) - Taiwan detected AI-assisted cyberattacks on government agencies last month coming from overseas but the affected bodies successfully "handled" the incident, the Ministry of Digital Affairs said on Thursday. Taiwan has in recent years complained about what it sees as China's "hybrid warfare" -- from daily military drills near the island to disinformation campaigns and cyberattacks -- as Beijing ramps up military and political pressure on the democratically governed island to force Taipei to accept its claims of sovereignty. Chinese cyberattacks on Taiwan's key infrastructure from hospitals to banks rose 6% in 2025 from the previous year to an average of 2.63 million attacks a day, the island's National Security Bureau said in January, adding some of the hacks were synchronised with military drills in "hybrid threats" to paralyse the island. In a statement, the Ministry of Digital Affairs said its cybersecurity monitoring units detected the "abnormal attack" targeting government agencies in July, and beginning July 20, its National Institute of Cyber Security issued a series of warning alerts while it investigated. The investigation results showed the attacks displayed clear characteristics of an "overseas source", with hackers employing a hybrid approach that combined manual operations with AI agent-assisted attacks, such as Open Claw, it said. "The relevant attack sources, methods, and scope of impact have all been fully investigated, and the affected units have successively completed their handling," the ministry added. In response to this new type of AI-derived cybersecurity threat, the government has established protective guidelines and strengthened system monitoring across agencies to block attacks early, it said. The statement did not mention China, and China's Taiwan Affairs Office did not immediately respond to a request for comment on the attack. ISRAELI FIRM'S REPORT Taiwan's statement came a day after the Israeli cybersecurity company Dream said in a blog post that it had uncovered an AI-driven hacking campaign that stole credentials and other data from an unnamed government in Asia. Dream said a team of AI agents worked together to extract scores of passwords from unidentified officials, steal personnel records from Taiwan's justice ministry, and scan its nuclear safety agency for vulnerabilities over the course of four days. Dream, which said it was able to reconstruct the hacking campaign after recovering the agents' "complete operational workspace," declined to share the data or name the government when approached by Reuters, but the Financial Times, which was the first media outlet briefed on Dream's findings, identified the target agencies as Taiwanese. (Reporting by Ben Blanchard and Raphael Satter; Additional reporting by Ryan Woo in Beijing; Editing by Kate Mayberry) By Ben Blanchard and Raphael Satter