Hackers linked to China have carried out an unprecedented, almost entirely autonomous cyberattack on Taiwan using artificial intelligence tools.
Hackers linked to China have carried out an unprecedented, almost entirely autonomous cyberattack on Taiwan using artificial intelligence tools.
According to the Financial Times, the attackers used open-source artificial intelligence agents to create an autonomous hacking tool.
The AI tool used in the attack behaved like a coordinated cyber command, and its work was first discovered by the team at Israeli cybersecurity and AI startup Dream.
Over four days in early July, the AI tool simultaneously deployed up to eight autonomous agents that mapped 21 Taiwanese government systems, probing for vulnerabilities and changing tactics as they were blocked.
Dream’s research found that the AI tool used by the hackers compromised at least 85 government user accounts, extracting more than 2,500 personal records. The attack also spread to Taiwan’s nuclear safety agency and at least seven energy companies, among others.
Dream’s Chief Strategy Officer Amir Becker, who previously headed operations for the elite Israeli intelligence cyber unit 8200, said he had never seen such an «end-to-end autonomous attack» on a government target before.
According to him, the use of artificial intelligence tools in cyberattacks means that governments must now assume that they are under constant cyberattack.
A spokesman for Taiwan’s Ministry of Digital Affairs declined to comment on the breach, citing privacy concerns.
«Hacker attack methods are becoming increasingly diverse, and in recent years, the integration of artificial intelligence technologies has further changed the nature of cybersecurity incidents. AI agents have brought new dual challenges to network security, as attacks are automated,» the spokesperson said.
According to researchers at Dream, evidence of the July cyberattack was found in a 160MB online archive uncovered during the company’s general investigations into the development of cybercriminal activity. The archive contained 1,395 files that show the hacking tool used two open-source AI agent systems, Hermes and OpenClaw.
While the researchers were unable to determine which AI model was used to power the agents, the data showed that the model’s safeguards were circumvented by presenting the hacking activity as an authorized exercise to test system vulnerabilities.
The most striking feature of the July attack was how the tool constantly ranked and reprioritized possible attack paths. When one attack path failed, the tool deployed another.
We previously reported on how a Chinese hacker used DeepSeek via Telegram for autonomous cyberattacks.
At the same time, as dev.ua wrote, a study by Microsoft cyber experts indicates that Russian hackers are infecting Wi-Fi networks in hotels around the world.
Comment hidden for violating commenting rules.