Eight Agents, Four Days, and a Government That Calls It Hybrid

TAIPEI, 13 AUG 2026 — Taiwan's Ministry of Digital Affairs confirmed on Thursday that government agencies were attacked in July using what it called a hybrid approach, combining manual operations with AI agent-assisted attacks. The Israeli security firm Dream, which published its analysis a day earlier, describes the same campaign in stronger terms: up to eight agents running in parallel across four days, mapping systems, researching flaws and changing tactics when blocked.

Both accounts are probably accurate. The distance between them is where the useful reading sits.

What happened

The platform was not custom malware. Dream reports it was assembled from publicly available agent frameworks — Hermes and OpenClaw — the same kind of open-source scaffolding a developer would use to build any multi-step agent. Taiwan's ministry named OpenClaw too, which is a rare case of an official statement and a vendor report agreeing on a specific technical detail.

According to Dream, the system adapted using a loop they call Learning Cycles. When agents met resistance, they would search vulnerability databases and GitHub for another way in, then resume the attack. That is not a novel capability. It is an ordinary agent pattern pointed at an unusual target.

The bypass is the part worth copying down

The safeguards in the underlying model were defeated by framing the entire operation as an authorised penetration test.

No exotic jailbreak, no adversarial suffix, no fine-tuned weights. The agents were told the destructive work was sanctioned security research, and they proceeded on that basis.

This is a hard problem to fix. The reason is fundamental. The difference between a red team and an intrusion is not technical. Identical commands, identical tools, identical targets — the only thing separating them is authorisation, which is a fact about the world outside the model's context window. A model asked to verify it would have nothing to check against. It can only be told, and being told is exactly what the attacker controls.

Any safety layer that relies on the operator's stated intent is vulnerable in the same way. As agents need less supervision, this kind of control becomes less reliable.

What "autonomous" is doing in that sentence

Three descriptions of one campaign, and they do not match.

Dream's own write-up undercuts the boldest reading of its finding. Building the system, the firm says, "takes more work than 'just' running a model. It demands careful adjustment to the specific task, optimization of agent coordination, and fine-tuning of decision logic."

Read that as an engineering description rather than a caveat. Somebody chose the targets, assembled the frameworks, wrote the authorisation cover story, tuned how the agents hand work to each other, and decided what counted as success. The agents then executed for four days without needing to be told what to do next.

This is not the arrival of a machine that hacks by itself, but it is a meaningful change. The expensive, skilled, hour-by-hour work of an intrusion — the part that kept an operator at a keyboard — was delegated to the agents.

Why a nuclear regulator, and why the order matters

The sequence in Dream's account reads more like a plan than a list. Government accounts and a personnel database first. Then the nuclear safety agency, the government email system, IT supply-chain vendors and energy companies.

Two and a half thousand personnel records are not valuable in themselves. They were valuable as input for everything that came next. With names, roles and addresses, a convincing email to an energy company can look like it came from its regulator. A roster taken in step one is targeting material for step three.

The regulator is a rational target for a related reason. It is not the plant, so it is usually defended like an office rather than like critical infrastructure — while holding inspection findings, correspondence and schedules for facilities that are defended properly. Attacking the body that oversees the thing is frequently easier than attacking the thing.

Why it matters even if it is hybrid

The thing that scales here is attention, not capability.

A human operator can run one intrusion carefully. Eight agents supervised by one operator can run eight, and can keep running while that operator sleeps. The campaign widened from government systems to a nuclear regulator, its vendors, and energy companies. This was not because the tooling got cleverer; it was because widening the attack cost almost nothing.

We made the same argument about the Zoom exploit published this week, where researchers went from a decompiled binary to a working zero-click in under a day. That was the disclosure side of the same economics. This is the other side, and the two arrived in the same week from unrelated directions.

The attribution, weighed

Reporting describes the operators as suspected China-linked. No published account we could read attaches a confidence level to that, and none names a tracked group.

Taiwan's own statement says the attacks came from overseas and stops there. That restraint is normal, but also informative. A government with strong reasons to name China chose not to.

Remember that Dream is a commercial security firm publishing research about its own products. That does not make the technical account wrong, but "first near-autonomous attack on a government" is a commercially valuable claim, and the qualifier shifts between "autonomous" and "near-autonomous" in the retelling.

What to do

The most useful finding is that nothing here requires a new class of defence. The agents used known vulnerabilities found in public databases and moved through systems the ordinary way. Patch latency, account hygiene and lateral-movement detection are the controls that would have mattered, exactly as they were last year.

What changes is the rate. If an intrusion that used to be one operator's full attention is now one operator plus eight workers, then the interval between your exposure appearing and somebody arriving at it gets shorter, and every control tuned to the old interval is now tuned wrong.

Two specifics worth acting on. Government and infrastructure operators should assume supply-chain vendors are in scope from the first hour rather than the second week — this campaign reached them early, because an agent with a target list does not triage by convenience. And anyone running agent frameworks internally should examine what an authorisation claim unlocks in their own stack. That is the control that failed here.

What to watch

Whether any independent party reproduces Dream's timeline. One firm's reconstruction of somebody else's four days is a hypothesis until a second one agrees.

Whether the agent frameworks respond. Hermes and OpenClaw are open source and were used as published; there is no patch for being general-purpose, which makes this a governance question rather than an engineering one.

And whether Taiwan publishes more. The ministry gave no numbers, named no agencies and confirmed no data loss. Everything quantified in this article comes from a vendor, and the government that was attacked has so far declined to corroborate any of it.