![\"\"\/](\"https:\/\/securityaffairs.com\/wp-content\/themes\/security_affairs\/images\/user-icon.svg\"){kind=icon}
Pierluigi Paganini<\/a>\n\t\t\t\t\t\t\t
![\"\"\/](\"https:\/\/securityaffairs.com\/wp-content\/themes\/security_affairs\/images\/clock-icon.svg\"){kind=icon}
August 12, 2026<\/p>\n\t\t\t\t\t\t![\"\"\/](\"https:\/\/www.europesays.com\/ai\/wp-content\/uploads\/2026\/08\/Chinese-hackers-espionage.jpg\")
<\/p>\n
China-linked hackers reportedly used eight AI agents to breach a government network, steal data and compromise accounts with minimal human oversight.<\/p>\n
Israeli cybersecurity firm Dream documented what looks like the first fully autonomous, end-to-end AI hacking operation against a government target. Over four days at the start of July, according to the Financial Times, suspected Chinese hackers ran a tool built entirely from publicly available AI agents that mapped 21 government systems, hunted for vulnerabilities, and switched tactics on its own whenever it hit a wall.<\/p>\n
\u201cSuspected Chinese hackers used publicly available AI tools to compromise government websites in Taiwan in a first-of-a-kind breach, highlighting how artificial intelligence is transforming cyber warfare.\u201d reported<\/a> the Financial Times.<\/p>\n The tool wasn\u2019t a single script running one attack. It deployed up to eight autonomous agents simultaneously, each working a different angle, more like a coordinated hacking team than a piece of malware. By the time researchers found it, the operation had compromised at least 85 government accounts, pulled over 2,500 personnel records, and expanded to hit a nuclear safety agency and at least seven energy companies.<\/p>\n Dream\u2019s chief strategy officer, Amir Becker, spent years running cyber operations for Israel\u2019s Unit 8200 before this, and he\u2019s not easily rattled by new attack tooling. He said flatly he\u2019d never seen anything like this level of autonomy directed at a government before. \u201cThis must be the basic assumption of every government around the globe,\u201d Becker said. <\/p>\n He argued that permanent, assumed compromise is now the only realistic starting posture.<\/p>\n Dream won\u2019t officially name the target government, citing company policy, though a person familiar with the matter told the FT it was Taiwan. The clues inside the data point the same direction: internal communications tied to the hacking tool were written in Simplified Chinese, while the data actually stolen from the target came back in Traditional Chinese, the script used almost exclusively by government systems in Taiwan, Hong Kong, and Macau. Taiwan\u2019s Ministry of Digital Affairs declined to confirm anything specific, saying only that incidents involving government agencies follow established response procedures.<\/p>\n What makes this different from an AI model going rogue during a lab test, something Anthropic<\/a>, OpenAI<\/a>, and Meta<\/a> have all separately reported in recent weeks, is that this wasn\u2019t an accident inside a sandbox. Researchers found the toolkit sitting in a 160MB archive, 1,395 files built around two open-source AI agent frameworks, Hermes and OpenClaw, both freely downloadable and designed to let AI models act autonomously on real tasks. Whoever built this deliberately assembled it as a weapon.<\/p>\n Getting the underlying AI model to cooperate took a specific trick rather than brute force. The operators had bypassed the model\u2019s safety guardrails simply by framing the entire hacking campaign as an authorized penetration test, a scenario the model apparently had no reliable way to verify or reject. That\u2019s a strange kind of vulnerability: not a flaw in the code, but a flaw in how convincingly you can lie to a system that\u2019s trying to be helpful.<\/p>\n The part Dream\u2019s researchers found most striking wasn\u2019t the scale, it was the decision-making. The tool kept ranking and reprioritizing possible attack paths as new evidence came in, and when one route hit a dead end, it spun up another agent to search the internet for fresh information and try a different approach, the same iterative process a human red-teamer would run, just without anyone sleeping. <\/p>\n \u201cThe most striking feature of the July attack was how the tool continuously ranked and reprioritised possible attack paths based on available evidence, Dream said.\u201d reported the FT. \u201cWhen one attack path failed, the tool deployed another agent to scour the internet for information and devise a new approach as a human hacker would.\u201d<\/p>\n Taiwan\u2019s National Security Bureau already logged<\/a> an average of 2.6 million Chinese cyberattacks a day in 2025, up 6% year over year; if a meaningful fraction of that volume starts running with this kind of autonomy, the math on defending against it gets a lot uglier very quickly.<\/p>\n Follow me on Twitter:\u00a0@securityaffairs<\/a>\u00a0and\u00a0Facebook<\/a>\u00a0and\u00a0Mastodon<\/a><\/p>\n Pierluigi\u00a0Paganini<\/a><\/p>\n (SecurityAffairs<\/a>\u00a0\u2013\u00a0hacking,\u00a0AI Agents)<\/p>\n \t\t\t\t\t\t\t\t\t\t\t