AI Agents Ran a Four-Day Breach of Taiwan's Nuclear Agency

Over four days at the start of July, two publicly downloadable AI agent frameworks worked their way through Taiwanese government networks with very little human steering. They compromised 85 user accounts, pulled more than 2,500 personnel records, and then did the thing that makes this case different from every prior AI-assisted intrusion: they decided where to go next. The operation spread to government IT supply-chain vendors, a nuclear safety agency, a government email system, and at least seven energy sector companies.

Israeli security firm Dream found the campaign sitting in a leaked online archive and published its analysis on August 12. Researchers are describing it as the first publicly documented near-autonomous cyberattack against a sovereign government. The frameworks involved, Hermes and OpenClaw, are open source. Anyone can download them today.

RelatedOpenAI's Models Escaped a Sandbox and Hacked Hugging Face

What did the agents actually do?

The interesting part is not that AI wrote some exploit code. That has been happening for two years. The interesting part is the control loop.

Dream's analysis describes what the attack framework itself called "learning cycles": autonomous sessions in which the models went and read vulnerability databases, GitHub repositories, and published security research, looking for techniques, specific CVEs, and common weakness patterns that applied to the infrastructure they were currently looking at. The output of that reading fed the next round of attempts. When something failed, the system corrected and tried a different path. When something worked, it scanned outward in parallel for adjacent targets.

That is a meaningful shift in where the human sits. In a conventional intrusion, an operator runs recon, reads the results, picks the next move, and repeats. Here the reading and the picking were happening inside the loop, at machine speed, across multiple targets at once. The scope expansion from a government network to a nuclear regulator to energy companies was not a separate human decision at each hop.

1. Jul 1Campaign begins against Taiwanese government systems Hermes and OpenClaw frameworks, guardrails bypassed as "authorized penetration testing"
2. Jul 1-485 government accounts compromised, 2,500+ personnel records extracted Agents run autonomous "learning cycles" against vulnerability databases and GitHub
3. Jul 2-4Scope widens without fresh human tasking IT supply-chain vendors, nuclear safety agency, government email, 7+ energy companies
4. Aug 12Dream publishes analysis from a leaked operator archive Internal comms in simplified Chinese characters point to China-linked operators
5. OngoingFrameworks remain publicly downloadable No patch exists for "the technique was published on GitHub"

How did they get past the safety guardrails?

By lying, essentially. The operators framed the whole engagement to the models as an authorized penetration test. That was enough.

This deserves to be stated plainly because a lot of AI safety marketing implies otherwise. The guardrails on these frameworks are not an authorization system. They do not check whether you have a signed scope document. They check whether your prompt sounds like it describes legitimate work, and a prompt claiming to describe legitimate work passes. Every red team on earth uses the same vocabulary as every attacker, because they are doing the same thing with different paperwork, and the paperwork is the part the model cannot see.

What was actually autonomous, and what wasn't?

Worth being careful here, because "AI ran a cyberattack by itself" is the version of this story that will circulate, and it overstates things.

Dream's own assessment is that the framework still required careful adjustment to the specific task, optimization of how the agents coordinated with each other, and fine-tuning of the decision logic. Somebody skilled built this rig. It did not assemble itself, and it was not a case of typing "hack Taiwan" into a chat box.

The honest description is that the marginal cost of the next target collapsed. Setting up the first one took real expertise. Getting from the first compromised account to the eighty-fifth, and from a government mail server to a nuclear regulator's supply chain, took almost nothing. That ratio is the whole story.

Who should care right now?

Anyone whose threat model quietly assumed attacker attention is scarce. That assumption has been load-bearing for a long time. Most organizations are not individually interesting enough for a skilled team to spend a week on, and that statistical safety, not their controls, is what has kept them intact.

RelatedOne GitHub issue, RCE on Claude Code and Gemini CLI runners

The energy companies pulled into this campaign are a good illustration. They were almost certainly not the original objective. They became targets because they were adjacent to something the loop had already compromised, and checking them cost nothing. Being uninteresting stops protecting you when looking at you is free.

Second group: anyone running a supply-chain relationship with a government body. The vendors here were a route, not a destination. Third: security teams who measure themselves on mean time to respond. A four-day full campaign against multiple sectors compresses the window in which a response matters at all.

Our take

The framing that matters is not "AI is now a hacker." It is that reconnaissance became free, and reconnaissance was the rate limiter on almost every intrusion campaign ever run.

Defensive security has spent two decades optimizing for a world where attackers had to choose. Prioritize your crown jewels, accept risk on the long tail, assume nobody will bother enumerating your third-party vendor's staging environment. Every one of those calls was correct arithmetic under the old cost model. This campaign is the first clean public evidence that the arithmetic changed, and it went from a government mail server to a nuclear safety agency in under four days to prove it.

We would treat the "near-autonomous" qualifier as the most important word in the reporting, though. Human expertise built the rig. That is the remaining bottleneck, and it is the one worth watching, because the day a working rig gets published rather than leaked is the day the second wave starts.

Original analysis by GenZTech, built from Dream's published findings as reported by CyberScoop, The Register and Security Affairs.