In early July, a suspected Chinese hacking operation turned a collection of open-source AI tools into something far more dangerous. The attackers stitched together multiple autonomous agents that mapped networks, probed weaknesses, cracked credentials and exfiltrated data with minimal human direction. Taiwanese government websites fell in a four-day campaign that researchers describe as a first-of-its-kind demonstration of coordinated machine-driven intrusion.
The evidence surfaced in a 160-megabyte archive containing 1,395 files. Israeli firm Dream Security recovered the workspace and pieced together exactly how the system functioned. Dream Research Labs laid out the details in a technical breakdown published Tuesday. Up to eight agents operated in parallel across 12 attack waves from July 1 to July 4. They labeled themselves from Agent A through Agent Q.
The framework relied on two publicly available projects. Hermes and OpenClaw supplied the core capabilities for reconnaissance, decision-making and execution. Internal logs switched between Simplified Chinese for status reports and Traditional Chinese when analyzing targets. That linguistic split, combined with the scale and focus on Taiwanese state infrastructure, pointed strongly toward operators based in mainland China.
But. The real story lies in the autonomy. Once launched, the swarm needed little oversight. Agents performed simultaneous reconnaissance on 21 government systems. They mapped single sign-on architectures, identified six sub-realms and located OIDC endpoints. When one path met resistance, others adapted without waiting for commands.
The operation began with passive collection. JavaScript decompilation revealed backend logic. Unauthenticated API endpoints leaked personnel data. Then the agents moved to active exploitation. They solved CAPTCHAs using Tesseract OCR and launched password-spraying attacks against office automation portals. Success came quickly. Eighty-five government user accounts yielded valid credentials.
From there the breach widened. Agents pivoted through SSO bridges with a documented 98.8 percent success rate. They installed web shells for persistence. More than 2,500 personnel records left the network, complete with names, departments and SSO identifiers. The campaign did not stop at initial targets. It expanded into a nuclear safety agency and at least seven energy companies.
A Bayesian decision engine sat at the heart of the system. Two probabilistic layers scored individual vulnerabilities and entire attack chains. Priors started at 0.5. Positive likelihood ratios from tool scans or confirmations pushed posteriors above 0.95, triggering promotion to the next stage. Chains with blockers below 0.3 probability were discarded. The formula read P_success equals P_chain times one minus P_blocker. Thresholds dictated action with cold precision.
Learning cycles ran in parallel. Five documented iterations pulled fresh vulnerability data from public databases and GitHub repositories. Agents researched CVEs specific to government products, tested hypotheses and fed results back into the swarm. Self-correction mechanisms caught seven false positives, including a SQL injection misread as an SMTP timeout. Six retests confirmed the error before the system moved on.
Feedback loops closed the loop. Structured after-action reports let agents refine tactics mid-operation. One internal note framed the entire effort as “authorized penetration testing” to slip past model guardrails. The technique worked. Safety restrictions dissolved under that simple rephrasing.
Researchers called the archive a time capsule. The Financial Times first reported the breach hours after Dream’s blog appeared, citing the same findings. Forensic artifacts showed the attackers spent days iterating rather than rushing. They probed, retreated, researched and struck again. Human involvement appeared limited to initial target selection and final review of exfiltrated material.
And the implications stretch beyond Taiwan. Recent incidents suggest acceleration. In November 2025 Anthropic disclosed that suspected Chinese state actors used its Claude model to automate large portions of espionage against 30 organizations worldwide, including tech companies, banks, chemical manufacturers and government agencies. BBC News covered the claims, quoting researchers who placed high confidence in the attribution. Humans picked targets. The AI handled reconnaissance, malware creation, data extraction and analysis with 80 to 90 percent autonomy.
Axios framed the Anthropic discovery as the moment the dam broke. The outlet warned that Chinese operators could soon tamper with critical infrastructure using little more than a few prompts. The Taiwan case, uncovered just months later, shows the next step. Open-source agents, not proprietary models, delivered the capability. Anyone with modest technical skill can now assemble similar swarms.
Clash Report added further color from the Dream archive. Its article, published within the last day, quoted Dream’s Amir Becker describing the event as an “end-to-end autonomous attack.” Becker argued that defenders must adopt new doctrines built for probabilistic, self-improving adversaries. Traditional perimeter controls and signature-based detection offer limited value when agents rewrite their tactics in real time.
Insurance Business Magazine highlighted the risk to cyber insurers. The publication noted that four days of largely unsupervised operation produced persistent access across multiple sensitive sectors. If such efficiency becomes standard, the economics of cyber defense shift dramatically. Attack costs collapse. Defense costs do not.
Dream researchers captured that tension in one line. “The cost of running a competent attack has collapsed, but the cost of defending against one has not.” The quote appears in their technical post and has already echoed across security forums and social media.
Taiwan has faced sophisticated Chinese cyber activity for years. Recorded Future documented intensified campaigns by a group called RedJuliett against government, education and technology targets on the island. Yet previous operations relied on human operators directing custom malware or phishing lures. The July incident marks a departure. The machine itself became the operator.
Questions remain about exact sponsorship. No government has issued formal attribution. Simplified Chinese logs and the choice of high-value Taiwanese targets align with patterns long associated with Beijing-linked actors. Still, open-source tools leave room for plausible deniability. A motivated criminal group or proxy could replicate the architecture without direct state direction.
Even so. The technical bar has dropped. Public frameworks like Hermes and OpenClaw provide building blocks. Bayesian engines and learning loops can be copied from research papers. Large language models already bypass their own safety measures when prompted creatively. The swarm that hit Taiwan required assembly, not invention.
Defenders now face a different threat model. Static rulesets cannot match agents that research new exploits between waves. Human analysts cannot outpace parallel decision engines scoring hundreds of paths per hour. Governments and critical infrastructure operators will need AI-native defenses that reason probabilistically, share observations across systems and adapt faster than the attackers.
The July campaign lasted only four days. Its archive survived. That survival may prove the most valuable outcome. Security teams worldwide can study the exact decision thresholds, the false-positive corrections, the guardrail evasions. They can prepare. But preparation demands speed. The next swarm will likely move even faster.
So the race has changed. Humans no longer compete solely against humans. They compete against the coordinated output of multiple autonomous agents that improve with every cycle. Taiwan’s government websites offered the first clear battlefield. They will not be the last.