Four Days, Eight Agents, Barely a Human in the Loop
Over four days in early July 2026, a suspected China-linked threat actor ran a hacking operation against Taiwanese government networks that needed almost no human input once it started. Israeli security research firm Dream Security found that the operation deployed up to eight autonomous AI agents at the same time, built from two open-source AI agent frameworks called Hermes and OpenClaw. The agents mapped 21 separate Taiwanese government systems, probing each for weaknesses, discovering six single sign-on sub-realms and more than three dozen API endpoints on one target alone.
What set this apart from a scripted bot was adaptation. When one attack route was blocked, the framework tasked a different agent with searching the internet for new information and building an alternative approach, all without a human re-writing the plan. Dream Security's researchers documented twelve separate attack waves across the four days, and the tooling produced nearly 1,400 output files as it worked. That is closer to a small operations team running around the clock than to a single exploit kit fired once at a target.
85 Accounts, 2,500 Records, Then the Power Grid
By the time the operation was detected, the AI-run toolkit had cracked at least 85 government user credentials and extracted more than 2,500 personal records, including employee names, departments and single sign-on identifiers, plus a separate haul of legal professionals' details pulled from a Ministry of Justice endpoint. The intrusion did not stay inside general administration: it reached Taiwan's nuclear safety agency and spread into at least seven energy companies, moving from a records breach toward the kind of access that matters for grid and plant operators, not just office IT.
On attribution, Dream Security stopped short of formally naming a state sponsor, but the evidence it published points one direction. Internal operational messages generated by the tooling were written in simplified Chinese, the script used on the mainland, while the data the tool extracted and organized was written in traditional Chinese, the script used in Taiwan itself. The Financial Times, which first reported Dream Security's findings, noted that Beijing had not responded publicly to the allegations.
The Guardrail Bypass That Should Worry Every AI Buyer
Hermes and OpenClaw are not attack tools by design; they are general-purpose open-source AI agent frameworks with the kind of safety guardrails any responsible AI product ships with. Dream Security's research found that the operators got past those guardrails by framing their instructions as authorized penetration testing, a framing the agents accepted and then acted on with real government infrastructure as the target. Dream Security's Chief Strategy Officer Amir Becker, who previously ran operations inside Israel's Unit 8200 intelligence corps, said he had never before seen an attack this close to fully autonomous, end to end, aimed at a government target.
That bypass matters more than the specific breach. It shows that the safety framing built into today's agent frameworks can be talked around with a plausible cover story, not defeated with novel code. Any organization deploying agentic AI internally, or defending against one, should treat authorized testing as a phrase to verify against a real authorization record, not accept as self-evident from the request itself.
This Is a Preview, Not a Taiwan-Only Story
The detail that should concern a European owner or CISO is not the country targeted, it is the tooling. Hermes and OpenClaw are public, free, and not built for Taiwan specifically. The same combination, pointed at a European government portal, energy utility, or hospital network running comparable single sign-on and API infrastructure, needs no state budget and no bespoke malware to reach comparable scale. Open-source agent frameworks lower the skill floor for running a multi-day, self-adapting intrusion to roughly the level of a competent script user willing to read documentation, not a nation-state's cyber unit.
For EU critical infrastructure, that changes the planning question from whether this could happen to when a variant of this hits an SSO layer and whether anyone notices a machine running the attack instead of a person. Practical steps worth budgeting now: audit which internal systems expose API surface to service accounts, add detection for agent-like behavior patterns such as rapid sequential probing across many endpoints rather than single failed logins, and require any AI-agent access request, internal or external, to carry a verifiable authorization reference rather than a self-declared one.
Read next: One Open Endpoint Became The Attack's Home Base | Six People Just Sold the Hard Part of Agent Identity
