Suspected China-Linked Hackers Reportedly Used AI Agents to Compromise Taiwanese Government Systems and Exfiltrate Personnel Records

From July 1–4, 2026, suspected China-linked hackers reportedly used a multi-agent framework built on Hermes and OpenClaw to compromise Taiwanese government systems. The agents reportedly compromised 85 credentials and used persistent access to connected systems to exfiltrate more than 2,564 personnel records. Taiwan later confirmed an overseas AI-assisted campaign against government agencies, without attributing it to China.

Risk classification

• Primary risk domain: 4 Malicious actors
• Primary risk subdomain: 4.2 Cyberattacks, weapon development or use, and mass harm

The incident involved the deployment of an autonomous AI-agent framework to conduct coordinated cyberattacks against state infrastructure, representing a malicious use of AI for cyber-offensive operations.

Additional risk subdomains

• 2.1 Compromise of privacy by obtaining, leaking or correctly inferring sensitive information: The AI framework successfully exfiltrated over 2,564 sensitive personnel records containing non-public employee names, departments, and SSO IDs.

Causal factors

• Entity: Human
• Intent: Intentional
• Timing: Post-deployment

The cyberattack was intentionally initiated and directed by human threat actors using deployed AI agent frameworks to compromise government systems.

EU AI Act risk tier

• Risk tier: 2 High Risk

High Risk: The AI system was used to target and scan critical infrastructure, including a nuclear safety agency and multiple energy sector companies, which represents a significant threat to public safety and infrastructure security.

AI system and alleged parties

• AI system: Hermes
• AI purpose: Target Identification; Code Generation
• Behaviour type: Multi-agent
• Alleged developer: Peter Steinberger, Nous Research, Large language model developers, AI agent system developers
• Alleged deployer: Threat actors, hackers, China-linked threat actors, AI agent system deployers, Agentic threat actors
• Alleged harmed parties: Taiwanese government employees, Taiwanese government agencies, Taiwan Ministry of Justice, Privacy, National security and intelligence stakeholders, Information security, Governments, Government of Taiwan, Government agencies

Harm severity

Severity ratings are based on this scale.

Highest direct severity in any category: Substantial. Severity is scored from Negligible to Catastrophic in each harm category, for harm the reports describe as caused directly or indirectly by the AI system.

• Physical: direct Negligible, indirect Negligible
• Infrastructure: direct Negligible, indirect Negligible
• Property: direct Negligible, indirect Negligible
• Financial: direct Negligible, indirect Negligible
• Environmental: direct Negligible, indirect Negligible
• Malicious content: direct Negligible, indirect Negligible
• Differential treatment: direct Negligible, indirect Negligible
• Civil rights: direct Negligible, indirect Negligible
• Democracy: direct Negligible, indirect Negligible
• Privacy: direct Substantial, indirect Negligible
• Psychological: direct Negligible, indirect Negligible
• Epistemic: direct Negligible, indirect Negligible
• Child sexual exploitation and abuse: direct Negligible, indirect Negligible

Privacy

Reported: Yes, the report explicitly describes privacy violations where personal data was exfiltrated.

Directly caused: The AI framework exfiltrated 2,564+ personnel records, including names, departments, and SSO IDs of 1,409 employees, 916 users from an unauthenticated API, and 239 legal professionals.

Inferred additional harm: It is likely that additional personnel records or sensitive government communications were accessed or exfiltrated during the lateral movement phase across the connected systems.

People affected

• Occurrences reported: 1
• People reportedly harmed: 2564
• People reportedly exposed: 2564

Potential causes

Management

• Insufficient defensive resources: Cost of running AI attacks collapsed but defensive costs remained high.
• Weak SSO and MFA policies: Management failed to enforce MFA or restrict trust across systems.
• Delayed security monitoring: Warning alerts were only issued after abnormal attack activity began.

Technology

• Open-weights frontier-adjacent models: Models provide advanced reasoning capabilities to unauthorized operators.
• Advanced agentic frameworks: Hermes and OpenClaw enable autonomous planning and execution.
• Vulnerable model guardrails: Guardrails bypassed by framing activity as authorized pentesting.

Data Inputs

• Unauthenticated user data access: Exposed API endpoints provided employee usernames for credential spraying.
• Exposed integration documentation: GitBook portal hosted SSO guides and SDKs, facilitating scraping.
• Unprotected public repositories: Learning cycles scraped vulnerability databases and GitHub for exploits.

Human Factors

• Capable human operator intent: Human operator initiated the attack, setting objectives and directives.
• Developer oversight: Debug endpoints and unauthenticated APIs were left exposed in production.
• Predictable employee credentials: Employees used simple password patterns based on usernames and IDs.

Process and Methods

• Multi-agent coordination loops: Parallel dispatch and structured feedback loops optimized execution.
• Bayesian prioritization scoring: Two-layer decision engine dynamically prioritized high-value targets.
• Autonomous learning cycles: AI conducted automated research to adapt techniques mid-operation.

Information quality

• Classification confidence: High
• Reason for confidence: The incident is documented in detail by DREAM Lab's Threat Research team, which recovered the complete 160MB operational workspace of the attacker. The findings are corroborated by official statements from Taiwan's Ministry of Digital Affairs and reporting by major news outlets like Reuters and the Financial Times.
• Ambiguities identified: The exact identity of the threat actor is not confirmed, though linguistic analysis suggests a Chinese-language operator.
• Alternative interpretations: The attack could be interpreted as a standard human-led cyberattack that merely utilized AI scripts, rather than a fully autonomous AI-driven campaign.

Suspected Chinese-language threat actors deployed a highly autonomous multi-agent AI cyber-offensive framework against Taiwanese government agencies, critical infrastructure, and supply chains. While successfully mitigated, the incident demonstrates an evolved capability in AI-driven espionage and reconnaissance, posing a substantial threat to state sovereignty and information security.

• Overall national security impact: Substantial
• Scope: Single nation
• Primary target: Taiwan
• Alleged perpetrator: Chinese-language threat actor

Threat characteristics

• Imminence: Long-term. The specific attack was mitigated, but the deployment of autonomous multi-agent cyber-weapons represents an ongoing strategic concern.
• Autonomy: Human-supervised. The system operated with high autonomy, executing attack waves and learning cycles, but was initiated and directed by human threat actors.
• Novelty: Evolved capability. Represents a significant advancement in cyber-offensive operations, utilizing autonomous multi-agent LLM frameworks to execute complex attack chains.

Impact by dimension

• Physical security: Substantial. The AI framework scanned a nuclear safety agency and seven energy sector companies, representing a substantial reconnaissance threat to critical infrastructure.
• Information security: Substantial. Exfiltration of over 2,500 government personnel records and single sign-on identifiers compromises intelligence security and enables future targeted espionage.
• Sovereignty: Substantial. Coordinated cyberattack targeted Taiwanese government agencies, compromising 85 employee credentials and disrupting standard administrative functions.
• Economic security: Minor. Reconnaissance of IT supply chain vendors poses a minor threat to technological security, with potential for future supply chain compromise.
• Societal stability: Minor. Privacy compromise of over 2,500 government employees represents a minor impact on societal stability, lacking broad population-scale targeting.