Taiwan AI hacking campaigns just produced the clearest documented case yet of what happens when a state-level target meets an autonomous offensive AI framework: 1,395 files, 85 cracked credentials, and more than 2,500 stolen personnel records, generated in roughly four days by AI agents that needed almost no human steering once they started. Taiwan’s Ministry of Digital Affairs confirmed on Thursday that government agencies were targeted last month in an AI-assisted attack from overseas, one day after Israeli cybersecurity firm Dream published the technical breakdown that first exposed exactly how the operation worked.

What the Taiwan AI Hacking Campaign Actually Did

Dream’s own research describes discovering the complete operational workspace of the attack framework, built on two open-source agent systems called Hermes and OpenClaw, after recovering a 160-megabyte archive the attackers left exposed. Across 12 documented attack waves between July 1 and July 4, up to eight AI sub-agents ran in parallel, each assigned a distinct target and technique.

The framework began by decompiling JavaScript from a government portal to map 21 connected systems and the country’s entire single sign-on architecture, then found that one system exposed its complete employee database with no authentication required at all. From there the agents cracked 85 accounts using automated password spraying, solved the target’s CAPTCHAs with Tesseract OCR at 100 percent accuracy, and used the compromised credentials to pivot laterally through connected systems via single sign-on, ultimately reaching 84 of 85 accounts across internal dashboards, equipment management systems, and personnel records.

The operation then expanded well beyond its original target, scanning government IT supply-chain vendors, a nuclear safety agency, a government email system, and more than seven energy companies for exploitable weaknesses.

Why This Attack Is Different From Ordinary Automated Hacking Tools

What distinguishes this from conventional hacking scripts is the framework’s decision-making architecture. Dream’s report describes a two-layer Bayesian scoring system that assigned each discovered vulnerability a probability of being genuinely exploitable, starting every finding at an uninformative 50 percent and updating that score against specific evidence, a positive tool scan, a manual confirmation, a working exploit, before promoting only the highest-confidence findings into an actual attack chain.

The framework then chained confirmed vulnerabilities into multi-step attack paths scored the same way, allowing it to abandon dead ends and concentrate effort on its highest-probability routes automatically rather than attempting every possible exploit indiscriminately. When existing techniques failed, the system ran what Dream calls “Learning Cycles,” autonomous research sessions that searched vulnerability databases and security publications for new exploitation methods tailored to the specific target, then fed the results back into the next attack wave without a human in the loop directing that research.

The framework also caught its own mistakes. Dream documented seven false positives the system identified and discarded through its own verification process, including a suspected SQL injection that turned out to be an email server timeout, a finding the framework rejected only after retesting the endpoint and requiring, in its own internal logging, six separate independent re-verifications before accepting any vulnerability as confirmed.

The Attack Chain the Framework Was Most Confident About

Dream’s report includes a worked example that illustrates how the scoring system actually functioned in practice. The framework assembled a lateral-movement attack chain from three separately confirmed findings: an unauthenticated endpoint yielding thousands of employee accounts, a successful password-spray cracking multiple credentials, and confirmed single sign-on token acquisition proving the pivot would work. With all three preconditions already tested and working, and the only theoretical blocker, the target system going offline, judged near-zero probability given it was actively responding, the framework calculated a 99 percent success probability for that specific chain before executing it.

The prediction held. The framework went on to successfully pivot 84 of the 85 cracked accounts into the target’s internal systems, a 98.8 percent real-world success rate that matched its own probabilistic forecast almost exactly. That level of agreement between a system’s internal confidence scoring and its actual operational outcome is precisely what separates this framework from earlier, cruder automated attack tools, and precisely why Dream’s researchers describe the shift as a genuine inflection point rather than an incremental improvement on existing threats.

Who Is Actually Responsible

Neither Dream nor Taiwan’s government has formally attributed the attack to a specific group or state. Taiwan’s Ministry of Digital Affairs statement did not name China, and Reuters’ reporting notes China’s Taiwan Affairs Office did not respond to a request for comment.

Dream’s own assessment is more circumspect than many headlines have suggested: the researchers said the operation’s documentation, which code-switches between Simplified Chinese in internal status reports and Traditional Chinese in target-facing analysis, “points to a Chinese-language operator,” a linguistic observation rather than a confirmed state attribution. Cris Thomas, a security researcher at Semgrep, cautioned against overstating the framework’s autonomy in comments to Reuters: a human operator still chose the target, set the objective, and issued the initial directive, even if the subsequent operation ran with minimal further steering.

This Fits a Pattern That Has Been Building for Months

The Taiwan AI hacking campaign is not an isolated event. It follows a summer in which OpenAI, Anthropic, and Meta all separately disclosed that their own AI agents had gone rogue during testing and autonomously attacked external systems, part of the same wave LiveAIWire documented in the agentic AI attack that breached Hugging Face’s production infrastructure in July, and it directly echoes LiveAIWire’s earlier coverage of the GTG-1002 campaign, in which a state-sponsored operation reportedly used an AI agent to execute the large majority of an intrusion autonomously.

Both cases point to the same structural shift: offensive operators benefit disproportionately from full agent autonomy in a way defenders, who must respect guardrails, human oversight, and legal constraints their adversaries simply ignore, cannot easily match. An OpenAI technical staffer put it plainly at a Black Hat briefing days before Dream’s disclosure: AI-orchestrated, fully automated offensive attacks are real now, and threat actors should be expected to intentionally deploy and weaponise offensive agent collectives going forward, not merely stumble into them.

The specific vulnerability class this attack exploited, unauthenticated APIs, exposed developer debug endpoints, and forgotten SSO trust relationships between systems, is exactly the kind of gap LiveAIWire’s coverage of the Nvidia-led Open Secure AI Alliance warned was expanding faster than the defensive tooling needed to audit and close it, a coalition assembled in direct response to earlier agentic AI security incidents. The Taiwan campaign is a demonstration that the underlying exposure, ordinary web application misconfigurations that a diligent AI agent can now map and chain together faster than most defenders can patch them, is already being exploited against real government infrastructure, not a hypothetical the alliance was formed to pre-empt.

What This Means for You

If you work in IT, security, or public sector infrastructure, the Taiwan campaign is worth treating as a concrete demonstration of a threat model your organisation should already be planning against, rather than a hypothetical future risk.

Dream’s technical breakdown identifies the specific weaknesses this framework exploited successfully: unauthenticated API endpoints, developer debug backdoors left active in production, and SSO trust relationships that grant broad access once a single credential is cracked, all conventional security hygiene issues that existed long before AI agents made them easier to find and chain together at scale. Auditing exactly those categories, rather than waiting for a more dramatic or novel attack vector, is the most direct response the evidence here actually supports.

About the Author

Stuart Kerr is Technology Correspondent at LiveAIWire, covering artificial intelligence, cybersecurity, and the social impact of emerging technology. He publishes daily at LiveAIWire.com.