Israeli Firm Reveals First Known AI-Led Breach of Taiwanese Government Systems

An Israeli company Dream discovered an open 160 MB archive while monitoring cybercriminal forums. The archive contained 1,395 files including reports, logs and data exports that reconstructed an entire cyber operation conducted between 1 and 4 July 2026 against government systems later identified by Financial Times as belonging to Taiwan.

The operation consisted of 12 sequential waves. In each wave up to eight sub-agents operated in parallel, each assigned its own target and technique. After a human operator launched the system and defined initial scope, all reconnaissance, exploitation decisions, recovery from failed attempts and persistence actions were performed autonomously by the agents.

The agents began with a single government portal, downloaded its scripts and extracted embedded API endpoints and single-sign-on configuration. This produced a map of 21 linked government systems. They then exploited forgotten debug endpoints that required no authentication, ultimately obtaining 85 employee accounts and exfiltrating more than 2,500 personnel records while installing backdoors on state web applications.

The framework did not stop at primary targets. It expanded to government IT suppliers, the national email platform, at least seven energy companies and the nuclear safety agency, scanning them in parallel. All offensive tooling came from two freely available open-source projects: Hermes and OpenClaw. No proprietary exploits or closed-source components were present.

The model safety mechanisms were bypassed simply by describing the task as an authorized penetration test. Researchers could not identify the exact underlying model but noted that open-weight models typically apply weaker refusal filters. The operation left almost no zero-day artifacts; every successful compromise used exposed endpoints, disabled signature validation or missing authentication.

Detection was difficult because the agents produced traffic patterns that closely resembled normal automated scanning. The decisive difference appeared only after initial access: the agents used the 85 compromised accounts to move laterally through the single-sign-on fabric, achieving 84 successful authentications without triggering multi-factor prompts or user confirmation. The system also performed its own validation, rejecting seven false-positive findings after cross-checks by multiple agents.