In July 2026, government cybersecurity monitors began to flag anomalous activity on Taiwanese government infrastructure. The discovery was traced back to a 160-megabyte archive of agentic AI operational logs, and researchers quickly realized they were looking at a fully autonomous attack workspace. This is not the first or only case of autonomous AI agents carrying out malicious cyber activity, but it is a notable incident highlighting the crucial question of the agentic AI era: what happens when a threat actor can attack without the need for sleep, hesitation, or planning?
Building the Blueprint Without Human Help
The agentic AI attackers used a range of capabilities to make this four-day intrusion possible. The system decompiled a government portal’s code in order to extract hidden API endpoints and login architecture and infiltrate to carry out further activity. The agent system deployed waves of as many as eight sub-agents at a time to independently map 21 connected government systems and the national single sign-on structure without requiring any human input.
Once each target was infiltrated, the agents were able to discover and scrape software development kit (SDK) documentation in order to accelerate their reconnaissance efforts. One exposed database alone needed zero authentication to reveal over 2,500 employee records, underlining the severity of the risk presented by this autonomous network’s malicious behavior. According to Taiwan’s Ministry of Digital Affairs, an investigation revealed overseas origins behind the activity.
Getting in the Front Door
Before carrying out their reconnaissance and exfiltration efforts, the framework of AI agents first had to establish a presence within the targeted systems. Research into the incident turned up hidden developer endpoints that granted valid sessions without requiring any credentials. Even the CAPTCHA-protected login portal was easily defeated by the agentic attackers using automated optical character recognition (OCR) at high accuracy levels.
The system of AI agents was not able to carry out this activity solely due to technological sophistication, but also due to insufficient authentication settings and configurations on targeted accounts and networks. Predictable password patterns tied to employee IDs were used to gain access to 85 employee accounts across multiple rounds of password spray activity. One forged authentication token also enabled the attacking agents to bypass signature verification entirely.
From Foothold to Full Compromise
The agentic AI used a variety of methods to establish deeper operations once initial access was achieved. The agents tested cracked credentials automatically across every internally connected system, and nearly all compromised accounts pivoted successfully through a trusted single sign-on bridge. This enabled the agentic attack group to achieve lateral movement to areas with sensitive data and connections to further targets.
With this extensive access to sensitive areas, the attacking agents siphoned out personnel records, database credentials, and internal network maps in bulk. They also expanded operations beyond the initial target to IT vendors, a nuclear safety agency, and energy companies, highlighting the critical nature of the framework’s capabilities and goals.
The Machine's Judgment
The AI agents carrying out this malicious activity were able to make an inordinate amount of judgments and decisions at machine speed. A probability-scoring engine managed to rank findings and discard low-confidence leads without the need for human input. The attack paths themselves were scored based on the likelihood of a successful attack before the AI agents committed resources to them.
The system was also enabled by dedicated “learning cycles” to research new techniques mid-operation, allowing for the ongoing advancement and sophistication of malicious activity. The framework caught and discarded its own false positives, including a mistaken finding of a blind SQL injection opportunity. It achieved all of this with a basis in open-source agents OpenClaw and Hermes.
While the capabilities of this system of agents are demonstrable in the intrusion, there is more to the story than just the technological feats of agentic AI. “This is certainly a preview of where cyber conflict is headed; however, the important detail isn’t the autonomy, it’s the economics,” says Matt Hartman, Chief Strategy Officer at Merlin Group, a Tysons Corner, Virginia-based network of affiliates that invests in, enables, and scales cyber technology companies. “The operators used publicly available agent frameworks rather than bespoke nation-state tooling, and reportedly bypassed safeguards by presenting the activity as authorized penetration testing.”
Government Confirmation and Scope of the Danger
In the wake of discovering this incident, Taiwan’s Ministry of Digital Affairs confirmed the existence of a hybrid AI-assisted campaign of foreign origin. Officials described AI agents enabling faster, cheaper, and larger-scale attacks than what humans could possibly achieve on their own. Security researchers argue that defenders now need to implement the same probabilistic, adaptive tooling that attackers already have access to and make use of. This episode emphasizes that AI-enabled cyberwarfare is a present capability to protect against, not a hypothetical future scenario.
