Inside the First Confirmed Fully Autonomous AI Cyberattack on a Government

For years, "AI-powered cyberattack" has mostly meant AI-assisted phishing verbiage or a chatbot helping a mediocre hacker write slightly better malware. What Israeli security firm Dream disclosed this week looks like something categorically different: a multi-agent AI system that appears to have planned, executed, self-corrected, and adapted an intrusion campaign against Taiwanese government infrastructure with minimal human steering—reportedly the first known instance of a fully autonomous attack on a government.

Taiwan's Ministry of Digital Affairs (MODA) confirmed the incident in a statement, saying its monitoring units first spotted the anomalous activity in July, issued advisories starting July 20, and immediately opened an investigation. MODA said the investigation has concluded and affected agencies have remediated the intrusion.

Officials described the attack as clearly originating overseas and involving a hybrid approach that combined conventional hacking operations with AI agents, including one called OpenClaw. According to MODA, the AI agents were able to rapidly chain together multiple attack techniques and used backup and test systems as pivot points, giving the operation speed, low cost, and scale that would be difficult for a purely human-driven campaign to match.

[RELATED: Age of AI Cybercrime Report Gives Orgs Six-Month Window to Act]

Neither Taiwan nor Dream has confirmed the attackers' origin, though experts suspect a China-based operator.

Dream's research team says it uncovered the attackers' entire operational workspace—a 160-megabyte archive of roughly 1,400 files—while investigating the campaign. The framework was built on two open-source agent platforms, Hermes and OpenClaw, and ran up to eight sub-agents in parallel during each attack wave, with each agent assigned to a distinct target or technique. Across 12 documented waves over roughly four days in early July, the system reportedly mapped 21 connected government systems, cracked 85 employee accounts, and exfiltrated more than 2,500 personnel records, along with internal database credentials and SSO client secrets.

The attack chain followed a recognizable playbook, but executed at a pace and breadth that would strain a human red team.

• Reconnaissance: The framework decompiled JavaScript bundles from a government web portal to extract every embedded API endpoint, OAuth client ID, and Keycloak configuration, mapping the country's national single sign-on architecture—six sub-realms, signing keys, and every supported authentication flow—from a single starting point.

• Documentation harvesting: It located and scraped a public documentation site for the national SSO system, pulling down sample integration code and running its own AI-driven static analysis against it to surface potential flaws.

• Initial access: The system found undocumented debug endpoints that returned a valid authenticated session to any request, and separately ran automated, CAPTCHA-solving credential-spraying attacks against an employee portal—cracking 85 accounts by testing predictable password patterns tied to employee IDs. It also identified an API that accepted forged JSON Web Tokens because the signature-checking algorithm field was set to "none."

• Lateral movement: Using the cracked credentials, the framework tested access against every internal system trusted through the SSO bridge; 84 of the 85 accounts (98.8%) successfully pivoted into internal systems with no additional authentication required.

• Exfiltration: Combining backdoor access, cracked credentials, and unauthenticated APIs, the framework pulled personnel records, a full user database export, and internal network and credential details.

• Expansion: Rather than stopping at its primary targets, the system moved on to scan government IT supply-chain vendors, a nuclear safety agency, a government email system, and multiple energy-sector companies for the same categories of exposure.

"This is not the first AI-driven government attack. It's the first one we've heard about," said Trey Ford, Chief Strategy and Trust Officer at Bugcrowd. "The unit cost of running a capable intrusion has fallen off a cliff because AI has closed the skills gap, using open-source and free tooling, while the cost of defending an enterprise hasn't moved at all. That asymmetry, not the novelty of AI, is the number CISOs and boards need to sit with."

Ford continued, "An AI agent can map 21 systems and crack 85 accounts in four days because it never stops working and never runs out of ideas when one path fails. This is the power of AI driving these attacks at machine speed. What it can't do is know which of your 21 systems actually matters to the business or spot the one weird misconfiguration a seasoned researcher would flag on sight. Defenders now need that same combination—machine speed paired with irreplaceable human depth—or they're bringing a knife to a gunfight."

The part that should worry defenders more than the breach itself

The headline numbers are alarming, but Dream's report focuses on something more consequential than the specific records stolen: the framework's decision-making architecture. Rather than brute-forcing every possible vulnerability, the system used a two-layer Bayesian scoring model: one layer to rate the confidence of individual findings based on evidence like a positive tool scan or a manual confirmation, and a second layer to score entire multi-step attack chains by multiplying the fraction of already-confirmed steps against the estimated probability of an insurmountable blocker. In the case of its most successful chain—pivoting from a cracked SSO account into internal systems—the framework calculated a 99% probability of success before running it, and was validated when 98.8% of accounts succeeded.

The system also ran what its own logs called "Learning Cycles"—autonomous research sessions where it searched vulnerability databases, GitHub, and security publications for new techniques specifically relevant to the target government's technology stack—then fed the results back into its next wave of attacks, adapting mid-operation without a human directing the next move.

Perhaps most notable is that the framework caught its own mistakes. Dream's analysis found the system flagged and discarded seven false positives during the campaign, including a suspected SQL injection that its own agents later determined was actually just an email-server timeout. Findings only made it into the framework's confirmed results after surviving what its logs described as six separate rounds of independent verification. And when the framework's underlying models initially refused to carry out attack steps, the operators reportedly got around those guardrails simply by framing the entire operation as authorized penetration testing.

Dream's researchers also flagged a possible attribution clue: the operational documentation switches between Simplified Chinese in internal status reports and Traditional Chinese in target-facing analysis, which they say points toward a Chinese-language operator; though, again, neither Taiwan nor Dream has formally confirmed the attackers' identity or nation of origin.

Why this matters beyond Taiwan

This isn't the first time researchers have warned about AI systems taking unauthorized or unexpected actions during security testing, and it certainly won't be the last. What sets this incident apart is the combination of scale, autonomy, and confirmed real-world impact against government infrastructure rather than a lab demonstration or red-team exercise.

Dream's broader argument, echoed by a growing chorus of security researchers, is that the economics of offense have shifted faster than the economics of defense. Multi-agent frameworks built entirely on freely available open-source models and harnesses can now run reconnaissance, credential attacks, and lateral movement in parallel, at a volume and speed no human operations team could match, while continuously re-prioritizing which target to hit next based on live evidence rather than a static playbook.

For defenders, the implications are practical as much as philosophical. The specific technical failures this framework exploited—unauthenticated APIs left exposed in production, debug endpoints that were never removed, predictable password patterns tied to employee IDs, JWTs that accept an "none" algorithm, SSO trust relationships with no secondary authentication—are not novel. They're the same fundamentals security teams have been urging organizations to fix for years.

What's changed is that an AI system can now find, chain, and exploit all of them in days rather than weeks, at a scale that turns a handful of moderate misconfigurations into a serious breach. MODA's response—standing up new AI-specific threat guidance and cross-agency intelligence sharing—suggests governments are beginning to treat this as a distinct risk category rather than a variant of familiar nation-state activity. Whether other governments and critical infrastructure operators move as quickly may determine how many "first known" incidents like this one occur before defenses catch up.

Here is some additional commentary from cybersecurity solution provider experts.

Morey Haber, Chief Security Advisor at BeyondTrust, said:

• "The significance of this cyberattack is not simply that artificial intelligence was used for automating actor vectors. Threat actors have been using AI for reconnaissance, phishing, malware development, and vulnerability discovery for some time. The inflection point is AI autonomy. If the reporting is accurate, we are seeing AI agents transition from assisting threat actors to actively participating in the attack lifecycle with decreasing human intervention and increasing success. That alone changes the economics of cybercrime."

• "Traditionally, sophisticated attacks required skilled operators to perform reconnaissance, compromise identities, evaluate results, pivot between systems, and determine the next attack path. Agentic AI can potentially perform many of these activities simultaneously, continuously, at machine speed, and all the nefarious best practices to prevent detection. A threat actor no longer needs highly skilled operators to successfully penetrate an organization; AI can do it for them."

• "For the private sector, this means organizations should expect cyberattacks to become faster, more persistent, and significantly more intrusive. Most importantly, autonomous agents will not necessarily follow predefined incident playbooks. They can assess what they discover and dynamically select other paths to privileged access to obtain their objective."

• "Organizations, therefore, cannot fight machine-speed attacks exclusively with human-speed processes. Information security teams need automated detection, continuous identity monitoring, least privilege, just-in-time access, rapid credential revocation, and automated containment all backed by defensive AI to mitigate the risk."

• "This cyberattack may resemble the future of cyberwarfare, but it is equally likely to become the future of everyday cybercrime. Once autonomous attack techniques become repeatable, they will inevitably become commoditized and commercially available to threat actors just like ransomware and malware via cybercrime syndicates and dark web stores."

Diana Kelley, CISO at Noma Security, said:

• "This is an important signal about where offensive cyber operations are heading. While humans appear to have selected the initial targets and objectives, much of the campaign could be delegated to agents."

• "For the private sector, a big concern is the economics. AI agents can significantly lower an attacker's cost of doing business. Techniques that previously required a skilled team working for days can now be parallelized and automated. Defenders should expect more attacks from AI-assisted adversaries capable of continuously probing an environment and adapting as conditions change."

• "Private companies shouldn't view this solely as a government or military problem. In this incident, the reported activity expanded beyond government systems to suppliers and energy sector organizations. Cyberattacks can cross the boundary between public and private infrastructure, and agentic AI can make that happen faster."

• "Something that can get lost in the headlines, but bears highlighting, is that, as with previously reported AI-enabled attacks, the agents didn't rely on novel exploits. They leveraged known vulnerabilities and configuration issues such as exposed APIs, weak credentials, authentication flaws, and debug functionality left in production. Even when AI finds a zero-day, the publicly documented examples so far are still instances of known vulnerability classes."

• "That means defenders are capable of finding and fixing many of these exposures before an AI agent exploits them. AI agents make basic security failures easier to discover and exploit at scale, but strong identity controls, attack-path analysis, and eliminating exposed services and credentials can stop them from succeeding."