Hackers used autonomous AI agents to attack Taiwan. Is this the future of cyberwarfare?

Autonomous AI Systems Launch First Known Government Cyberattack on Taiwan

Goldlaner.com – A sophisticated cyber operation targeting Taiwan’s government infrastructure has revealed a new era in digital warfare, where artificial intelligence systems can independently plan, execute, and adapt hacking campaigns without human direction. The incident, uncovered during July 2026, represents what experts are calling the first fully autonomous attack on government agencies, marking a significant shift from traditional cyber threats.

Mapping and Breaching Government Networks

Over a concentrated four-day period, the AI-driven system demonstrated remarkable capabilities in penetrating Taiwan’s digital defenses. The autonomous agents successfully mapped 21 distinct government systems, cracked 85 user accounts belonging to government personnel, and extracted 2,500 personnel records from various agencies. These figures come from Dream, an Israeli artificial intelligence firm that identified and analyzed the attack patterns.

While investigators suspect Chinese actors behind the operation, neither Taiwan’s government nor Dream has officially confirmed the geographic origin of the hackers. Taiwan’s Ministry of Digital Affairs provided a statement on Thursday indicating that “the investigation found clear indications that the attacks originated overseas and involved a hybrid approach in which hackers combined conventional operations with AI agents such as OpenClaw.”

How the Autonomous System Operated

The hackers’ infrastructure relied on open-source AI agents to automate and coordinate nearly every phase of the intrusion. These agents handled reconnaissance activities, credential attacks, and strategic planning for subsequent attack paths. What distinguished this operation from previous cyber incidents was the level of autonomy—the system could make decisions, adapt strategies, and coordinate multiple agents simultaneously.

According to Kenny Huang, chairman of the Taiwan Network Information Center, this represents the first disclosed case of a fully automated attack against a government entity. While using AI to write code and search for vulnerabilities has become increasingly common in cybersecurity, this incident demonstrated something fundamentally different. An autonomous system coordinating up to eight AI agents effectively ran an entire hacking campaign rather than merely assisting human operators.

“It spells out one thing loudly – the cost of running a competent attack has collapsed, but the cost of defending against one has not,” Dream wrote in a blog post analyzing the incident.

Adaptive Attack Strategies

Amir Becker, Dream’s chief business and strategy officer, described the AI system’s behavior as particularly alarming. The agents demonstrated human-like adaptability, researching new techniques in real time when their initial approaches encountered resistance. “Like a human team, when an approach gets blocked, it researches new techniques in real time and adapts. It’s an attacker that strategizes, learns, and adjusts on its own,” Becker explained.

The attack’s reach extended beyond Taiwan’s core government agencies. The AI agents targeted the country’s nuclear safety agency, government IT vendors, and at least seven energy sector companies. The system’s ability to quickly combine different hacking techniques and exploit vulnerabilities in secondary systems allowed the attacks to proceed faster, more efficiently, and on a much larger scale than traditional operations.

Tracing the Attack to China

Evidence pointing toward Chinese involvement includes the use of simplified Chinese characters found in internal documents linked to the hack. Experts noted this suggests a high probability that the instigator, whether a public or private entity, maintains connections to China. CNN contacted China’s Ministry of Foreign Affairs, Taiwan Affairs Office, and Cyberspace Administration for official comment on the incident.

Taiwan has long been a target of cyber operations from its neighbor. Beijing claims the East Asian democracy as part of its territory and has repeatedly vowed to annex it, by force if necessary. Government reports indicate Taiwan experienced an average of 2.6 million cyberattacks daily from China last year, representing a 6 percent increase from 2024 levels.

Broader Implications for Cybersecurity

As Beijing has intensified its pressure campaign against Taipei in recent years, Taiwanese officials have described their democracy as standing at the forefront of China’s “hybrid warfare” strategy. This approach encompasses disinformation campaigns, cyberattacks, and near-daily military exercises surrounding Taiwan.

Huang emphasized that the July incident demonstrated AI’s evolution beyond partial automation tasks into a central player in cybersecurity. The incident raised critical questions about global preparedness for AI-driven threats. “I believe there are still significant gaps. Every country, not just Taiwan, is still unprepared in this respect,” Huang stated, highlighting concerns about legal frameworks, technical capabilities, and policies needed to address autonomous AI attacks.

The incident arrives amid growing reports of advanced AI models engaging in unauthorized actions, prompting calls for increased government regulation of artificial intelligence technologies. As AI agents become more sophisticated and autonomous, the cybersecurity landscape faces fundamental challenges in defense strategies, attribution mechanisms, and international response protocols.

Reporting by CNN’s Wayne Chang in Taiwan and Fred He in Beijing contributed to this article.