What happened: a four-day AI campaign against Taiwan's government
In early July 2026, an unidentified attacker launched an AI-agent campaign against Taiwanese government infrastructure. According to research by Israeli security firm Dream, the operation ran for four days with the agents working largely on their own.
The AI stack was open-source: agent frameworks OpenClaw and Hermes autonomously mapped networks, evaluated which vulnerabilities to exploit and adjusted tactics without a human making every decision. Taiwan's National Institute of Cyber Security detected the abnormal activity on July 20, issued alerts and contained the incident.
The scale became visible only after Dream analyzed the attackers' own leaked data archive — 160 MB across 1,395 files — and published its findings on August 12–13. Taiwan's Ministry of Digital Affairs (MODA) then confirmed that overseas AI-assisted attacks targeting government infrastructure had been detected and remediated.
The attack in numbers
- 8 AI agents running in parallel at peak
- 21 government systems mapped and scanned
- 85 administrative accounts compromised
- 2,500+ personnel records exfiltrated
- 7+ energy companies and 1 nuclear safety agency among the expanded targets
- 4 days from the start of the autonomous operation to containment
The arithmetic is worth sitting with: eight agents, four days, 21 systems — roughly five systems mapped per agent and about 21 account takeovers per day, with no one at the keyboard adjusting course. For security teams, this reframes the benchmark question. We usually measure models in tokens per second; attackers now measure campaigns in compromised accounts per day.
"Near-autonomous" means the operator set it and left
The word "near" matters. A human presumably set the overall objective, but the agents handled reconnaissance, vulnerability selection and re-planning on their own. That sits between classic scripted attacks and an imagined fully self-directed adversary — and it is the version that now demonstrably works against state networks.
The cost asymmetry is the uncomfortable part. OpenClaw and Hermes are open source, so the attacker's licensing bill for the agent software is zero, scaling from one agent to eight is nearly free, and there is no vendor that can shut off access. The defender's bill — detection, investigation, password resets, recovery, public disclosure — runs much higher. That is a structural advantage for attackers, and it will not shrink.
Attribution: simplified Chinese, no official blame
The leaked logs contain internal agent communications written in simplified Chinese characters, which researchers say suggests ties to China-linked threat actors. Taiwanese officials, however, confirmed only that the attacks came from overseas and stopped short of public state attribution. The public record does not support a firmer conclusion, and this article will not invent one.
Why this is a European story
First, the supply chain. Taiwan produces the bulk of the world's most advanced chips, and European carmakers, server vendors and AI infrastructure depend on that output. A successful multi-day intrusion into Taiwanese state networks — even a contained one — is a stress test of the island's resilience, and resilience there is a European industrial question.
Second, the timing with EU regulation. This campaign is exactly what the AI Act's high-risk provisions were designed to address: autonomous AI acting against critical infrastructure. Yet in mid-2026 the EU's AI Omnibus (Digital Simplification Package) deferred major high-risk compliance deadlines to December 2027 to cut red tape. The deferral may have administrative benefits, but it now coexists with the first documented near-autonomous attack on a national government network. European security planners should at least build threat models that assume this capability, not treat it as hypothetical.
Third, the attack surface. The Taiwan campaign combined government administration accounts with energy-sector targets and a nuclear safety agency. EU member states run comparable identity systems, comparable energy grids, comparable regulators — and they run them with open-source AI agents readily available on both sides of the fence.
What European CISOs should do this quarter
The defensive playbook here is not exotic — it is basic hygiene sharpened by a new threat model:
Treat identity as the critical control. 85 administrative accounts is not a perimeter breach; it is an identity breach. Phishing-resistant MFA and conditional access on privileged accounts are the realistic blockers.
Make logs reconstructable. Dream rebuilt the entire operation from a 160 MB archive. Most organizations still cannot reconstruct four days of intrusion from their own telemetry — which makes containment a hope rather than a process.
Automate detection, because the attacker automates action. Signature matching will not keep up with agents that re-plan in near-real time. Network anomaly detection and behaviour analytics are the minimum response.
None of this requires new legislation or procurement theater. It requires assuming that machine-speed adversaries are already inside the perimeter of the threat model — because for one government in July 2026, they demonstrably were.
Was the Taiwan attack fully autonomous?
No. Researchers describe it as "near-autonomous": a human operator set the campaign in motion, and the AI agents then performed network mapping, vulnerability assessment and tactic adjustment on their own for four days without real-time human steering.
Did the researchers blame a specific country?
Not officially. Internal agent communications used simplified Chinese characters, hinting at China-linked actors, but Taiwanese officials referred only to overseas sources and did not publicly attribute the attack to a state.
How much did the attack cost the attackers?
The agent frameworks used — OpenClaw and Hermes — are open-source, so the software itself cost nothing. The main expense would be the infrastructure to run eight AI agents for four days, which is small compared with the defender's detection, response and recovery costs.
