China-Linked Hackers Use Autonomous AI Agents to Breach Taiwan Government Systems

A China-linked threat actor has reportedly utilized a multi-agent artificial intelligence framework to conduct a nearly autonomous intrusion campaign targeting government entities in Taiwan and across Asia.

This operation demonstrates how agentic AI can reduce the operational costs and increase the speed of sophisticated cyberattacks.

Research from Dream Research Labs outlines an operation carried out between July 1 and July 4, 2026, during which AI agents allegedly generated 1,395 operational files, compromised 85 employee accounts, exfiltrated thousands of personnel records, and established persistent access to state-linked infrastructure.

China-Linked Hackers Breach Taiwan Government Systems

The framework reportedly combined the Hermes and OpenClaw agent platforms to coordinate up to eight sub-agents simultaneously during each attack wave.

Individual agents, labeled A through Q across 12 documented waves, were assigned specific functions, including reconnaissance, API enumeration, credential attacks, vulnerability validation, lateral movement, and supply-chain targeting.

Rather than functioning as a simple chatbot or a conventional automated scanner, the framework employed planning loops, persistent operational memory, parallel task execution, and structured after-action reporting to adapt its strategy throughout the campaign.

Initial reconnaissance began with the automated collection and decompilation of JavaScript bundles from an Angular-based government portal.

The agents extracted URLs, API endpoints, OAuth client identifiers, and Keycloak configuration objects, ultimately mapping 21 connected government systems and the overarching national single sign-on architecture.

Researchers noted that the operation identified multiple unauthenticated APIs, including one that exposed a large employee database containing names, departments, and single sign-on account identifiers.

The attack then expanded through several parallel access paths. The agents allegedly discovered exposed developer backdoor endpoints that returned authenticated sessions without requiring valid credentials.

They also utilized harvested usernames in password-spraying attempts against an office automation portal. CAPTCHA protections were reportedly circumvented using Tesseract optical character recognition.

At the same time, the framework tested predictable password patterns based on employee identifiers. This process led to the compromise of 85 accounts.

A separate authentication weakness enabled the creation of forged JSON Web Tokens when the token algorithm was set to none, eliminating the need for a valid signing key.

The compromised credentials facilitated rapid lateral movement. According to the report, 84 out of the 85 accounts successfully authenticated to an internal government information system through a trusted single sign-on bridge, yielding a 98.8 percent success rate.

The agents also attempted to deploy a web shell through an unrestricted upload function. Although this upload succeeded, a secondary Forms Authentication layer reportedly prevented execution, indicating that the framework could differentiate between partial success and complete compromise.

A key feature of the operation was a Bayesian decision engine that scored both individual vulnerabilities and multi-step attack chains. Findings were assigned posterior probabilities based on scan results, manual validation, impact assessments, and defensive constraints. Only high-confidence findings were promoted for exploitation.

The system also employed “Learning Cycles” to research public vulnerability databases, GitHub repositories, and security publications when an attack path encountered obstacles.

The report’s most concerning finding is not just a single flaw, but the apparent ability of agentic systems to self-correct and operate at scale.

The framework reportedly discarded seven false positives after repeated testing, including a presumed SQL injection that was later identified as an SMTP timeout.

For defenders, this incident underscores the necessity of eliminating exposed debug interfaces, enforcing multi-factor authentication (MFA), implementing rate limiting, securing APIs, rejecting unsigned JWTs, monitoring single sign-on trust relationships, and treating AI-driven attack automation as an immediate operational threat rather than a future possibility.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world