Near-Autonomous AI Agents Target Taiwan's Nuclear Safety Agency

Google News surfaced a stark security warning this week: near-autonomous AI agents reportedly attacked Taiwan’s government and nuclear safety agency during a four-day campaign.

The agents cracked government accounts, collected personnel records, and scanned critical infrastructure targets in parallel. Their human operators apparently provided strategic direction, while software handled much of the reconnaissance, exploitation, verification, and adaptation.

Cybersecurity company Dream reconstructed the operation from a 160 MB archive containing 1,395 files. Its researchers documented 12 attack waves between July 1 and July 4, 2026. The framework deployed as many as eight sub-agents at once.

That evidence does not establish a fully autonomous attack. It also does not prove sponsorship by the Chinese government. Dream identified a Chinese-language operator, while The Register connected the unnamed Asian target to Taiwan through a person familiar with the incident.

The more defensible conclusion is still significant. Publicly available agent software appears to have coordinated a real intrusion campaign at a speed and scale that would previously require a larger human team.

This is not mainly a story about one compromised agency. It is a test of whether conventional defenses can withstand attackers that research, validate, and redirect themselves continuously.

What the AI Agents Actually Did

The operation combined familiar security failures with an unusually automated system for finding, ranking, and exploiting them.

Dream said its researchers discovered the attacker’s operational workspace in early July. The archive documented compromises of government systems in Asia, although Dream did not publicly identify the affected country.

The company’s attack investigation describes a framework built with Hermes and OpenClaw. Both are publicly available agent systems that let language models use tools and complete multistep tasks.

The campaign began with an internet-facing government portal. Agents downloaded its JavaScript bundles and extracted URLs, application programming interface endpoints, OAuth client identifiers, and Keycloak configuration details.

That reconnaissance exposed connections to 21 government systems. It also mapped six single sign-on sub-realms, their authentication endpoints, two signing keys, and supported login flows.

On one target, the agents reportedly identified more than 36 API endpoints. Some returned sensitive information without first authenticating the requester.

One exposed interface revealed employee names, departments, and single sign-on identifiers. Those records gave the attackers a ready-made list of usernames for further access attempts.

The framework also found three hidden developer endpoints on a government application. According to Dream, each endpoint accepted arbitrary request data and returned a valid authenticated session.

Another application accepted JSON Web Tokens with their signature algorithm set to “none.” A JSON Web Token carries identity claims between systems, while its signature should prevent attackers from forging those claims.

These were serious server-side weaknesses. They did not require a previously unknown vulnerability or an exceptionally capable language model.

The agents then attacked an office automation portal using predictable password patterns derived from employee identifiers. They solved the portal’s CAPTCHA images with Tesseract, an established optical character recognition tool.

Dream reported 100 percent CAPTCHA-solving accuracy during the observed attempts. The framework cracked 85 accounts over several password-spraying rounds.

Password spraying tests a small group of likely passwords against many accounts. The method reduces the repeated failures on individual accounts that often trigger lockouts.

Eighty-four compromised accounts reportedly authenticated to an internal information system through a trusted single sign-on bridge. That gave the attackers access to dashboards, equipment interfaces, and personnel information.

The agents also uploaded a web shell through an unrestricted file-upload interface. A second authentication layer blocked its execution, so that attempt stopped short of remote code execution.

This mix of success and failure matters. The system was not an infallible digital attacker. It was an automated operator that kept testing alternative paths when one technique failed.

Google News Put the Nuclear Target in Focus

The nuclear reference raises the stakes, but available evidence does not show that reactor control or safety systems were compromised.

Dream said the framework expanded beyond its original government targets. It scanned IT suppliers, a government email service, a nuclear safety agency, and at least seven energy companies.

The Register subsequently reported that the affected nuclear organization was Taiwan’s Nuclear Safety Commission. Its security coverage cited a person familiar with the campaign.

That distinction deserves careful handling. The reporting establishes that the agency was targeted, but neither public account documents access to nuclear plant operational technology.

There is also no reported evidence of reactor manipulation, radiation release, or disruption to safety functions. The campaign focused on web applications, authentication systems, exposed interfaces, and organizational supply chains.

Taiwan’s Nuclear Safety Commission regulates nuclear and radiation safety. It also oversees cybersecurity requirements for critical digital assets at nuclear facilities.

The commission defines those assets as systems supporting safety, security, or emergency response. Its own cybersecurity guidance warns that their compromise could interfere with essential functions.

However, an agency website and a nuclear plant control network are not the same environment. Critical facilities generally separate business systems from operational systems through network segmentation and additional access controls.

Attackers still value the surrounding administrative environment. Employee identities, vendor relationships, internal addresses, and authentication details can support later intrusions or more convincing social engineering.

The campaign reportedly collected at least 2,564 personnel records. That total included 1,409 employee records, 916 users from an unauthenticated interface, and 239 legal professionals.

Dream also identified seven single sign-on client secrets and six database credentials across Microsoft SQL Server, Oracle, and Sybase systems. It said some secrets had already been rotated.

Those materials can reveal architecture even after direct credentials expire. Naming conventions, trust relationships, and internal network ranges help attackers plan follow-up operations.

The supply-chain expansion is therefore more important than the dramatic nuclear label alone. A government contractor can provide technical documentation, remote access, trusted software, or reusable credentials.

A swarm can scan several such targets simultaneously. Human operators no longer need to investigate every portal in sequence.

Google News readers should view the nuclear element as an escalation in targeting, not evidence of a nuclear emergency. The verified concern is exposure across a connected administrative ecosystem.

That ecosystem includes government applications, vendors, email services, energy companies, and security regulators. Weakness in one layer can create opportunities in another.

The Real Shift Is Automated Operational Judgment

The agents did more than run scanners because they ranked attack paths, researched new techniques, and corrected some of their own errors.

Automated hacking tools have existed for decades. Vulnerability scanners, credential-testing programs, exploit kits, and orchestration scripts already reduce the labor behind cyberattacks.

The reported framework differed through its decision loop. It assigned separate missions to sub-agents, collected their findings, and fed results into later attack waves.

Dream observed agents labeled with letters across the campaign. Up to eight worked concurrently, dispatched in three batches during one wave.

The system tracked 14 parallel attack chains. It reportedly used Bayesian scoring, a method for updating probabilities as new evidence arrives, to prioritize its next actions.

At the vulnerability level, the framework began each possible flaw with a neutral probability. Scanner results, manual confirmation, impact evidence, and defensive barriers then changed that score.

Findings above designated thresholds received more testing or promotion into an attack chain. Low-scoring findings were abandoned so resources could shift elsewhere.

The second layer estimated whether several confirmed weaknesses could form a complete intrusion path. It compared working steps with remaining blockers and assigned an overall success probability.

One single sign-on path received a 99 percent success estimate. The framework later authenticated 84 of 85 compromised accounts, producing a 98.8 percent observed rate.

A number that closely matches the outcome is not proof of advanced intelligence. The underlying conditions had already been tested, which made the prediction comparatively simple.

Still, the workflow shows disciplined operational automation. The system did not merely produce plausible text about vulnerabilities. It connected findings to live access attempts.

The framework also launched five “learning cycles.” During these sessions, agents searched vulnerability databases, public code repositories, and security publications for techniques relevant to the target.

That ability turns public defensive knowledge into offensive input. A newly published advisory can become part of an attacker’s planning loop without waiting for a person to read it.

The most revealing example involved a suspected SQL injection. An agent initially interpreted a 21-second response delay as evidence that injected database code had executed.

Later tests found that an email timeout caused the delay. The framework reclassified the result as a false positive and removed it from the validated list.

Dream said the final summary recorded seven such false positives. Confirmed findings reportedly underwent several independent retests before the system accepted them.

Self-correction remains an imperfect label. The agents followed a designed verification process, and a human operator likely shaped its thresholds and instructions.

Yet the result resembles operational judgment. The system allocated effort, challenged its findings, and changed course using evidence gathered during the campaign.

This creates a productivity imbalance. A defender must secure every exposed application, identity bridge, and vendor connection, while an agent swarm needs only one workable chain.

Organizations can improve that balance by maintaining a searchable technical knowledge base. Incident responders need fast access to ownership records, architecture notes, and prior remediation decisions.

Documentation alone will not stop an attack. It can reduce the time required to identify exposed systems and coordinate containment across teams.

Near-Autonomous Does Not Mean Unsupervised

The strongest claim concerns automated execution, while attribution, model choice, and the degree of human control remain unsettled.

Dream described the campaign as near-autonomous rather than fully autonomous. That wording acknowledges that people still selected targets, configured infrastructure, and established operational goals.

The archive reportedly showed extensive machine-generated output. Producing 1,395 files over four days is consistent with heavy automation, but volume cannot reveal every human intervention.

Operators might have reviewed plans between waves. They might also have approved sensitive steps, revised prompts, or redirected agents after failures.

The public report does not identify the underlying language model. Hermes and OpenClaw are agent harnesses, meaning they organize tools, memory, and task execution around a separate model.

This distinction matters for accountability. The same harness can connect to different commercial, open-weight, or locally hosted models.

Dream said the agents bypassed model refusals by describing their work as authorized penetration testing. That finding suggests policy controls depended partly on how the task was framed.

It does not prove that every model would behave identically. Model-level protections, tool permissions, network controls, and agent instructions can all affect the result.

Attribution is similarly limited. Dream did not name a hacking group or connect the operation directly to China’s government.

Its researchers found Simplified Chinese in internal reports and Traditional Chinese in target-facing analysis. They concluded that the evidence pointed to a Chinese-language operator.

That is a useful clue, but language is not identity. Attackers can deliberately alter language settings, reuse another operator’s material, or create misleading artifacts.

The Financial Times described the actors as China-linked and identified Taiwan as the victim. The Register independently reported Taiwan through an unnamed person familiar with the incident.

Those reports strengthen the geographic identification. They do not resolve state sponsorship or establish who directed the campaign.

The incident also illustrates a recurring verification problem in threat intelligence. Researchers often protect victims by withholding names, indicators, and technical details that would enable further exploitation.

That restraint can limit independent review. Outside analysts cannot fully reproduce Dream’s conclusions without the archive, raw logs, and affected organizations’ incident records.

Security vendors also have commercial incentives to emphasize new threat categories. Dream sells AI-focused defensive products to governments, so readers should distinguish its evidence from its broader market claims.

The technical findings remain concerning without adopting every conclusion. Exposed developer endpoints, unsigned tokens, weak passwords, and unauthenticated APIs are concrete defensive failures.

The AI system apparently made exploiting those failures more efficient. It did not create them.

That tension is central to the story. Better agent software increases offensive tempo, while familiar security debt determines whether the automation succeeds.

Public guidance from several national cybersecurity agencies recommends restricting agent permissions, isolating execution environments, and recording every agent action. Their joint agent security guidance also stresses controls that agents cannot override.

Those principles apply on both sides. Organizations deploying internal agents must prevent them from reaching systems or data beyond their intended tasks.

Defenders should also assume hostile agents will continuously retest exposed services. A vulnerability that seems obscure today can become a high-priority target after one automated research cycle.

Why Traditional Defenses Face More Pressure

Agent swarms compress the time between discovery and exploitation, forcing defenders to remove weaknesses before attackers can assemble them into chains.

Traditional security programs often separate responsibilities across application, identity, network, vendor, and incident-response teams. Attackers benefit when those groups lack a shared view.

The Taiwan campaign reportedly moved across exactly those boundaries. It began with public JavaScript, found authentication metadata, harvested usernames, tested passwords, and reused trusted sessions.

Each step was understandable in isolation. Their combination produced broad access.

Multifactor authentication would have disrupted the password-spraying path. Strong token validation would have blocked forged identities, while access controls could have protected personnel interfaces.

Removing production debug endpoints would close another entry point. Restricting file types and execution paths would reduce the risk from uploaded web shells.

These measures are ordinary security practice. The challenge is applying them consistently across 21 connected systems and the vendors surrounding them.

Agentic automation makes uneven coverage more costly. It can test several defenses at once and move toward the weakest one without fatigue.

Security operations centers also face an asymmetric data problem. One attacker can generate thousands of requests, findings, and variants, while analysts must decide which alerts represent real compromise.

Defenders therefore need more than automated alert generation. They need reliable asset inventories, enforceable identity boundaries, and rapid containment procedures.

Internet-facing portals deserve particular scrutiny. Compiled application files can expose endpoints and authentication details even when developers assume the code is difficult to inspect.

Secrets should never rely on obscurity inside client-side software. Public applications must also treat every API call as hostile until authentication and authorization checks succeed.

Single sign-on deserves equal attention. SSO simplifies legitimate access, but an overtrusted bridge can transform one stolen session into access across many systems.

Organizations should require phishing-resistant authentication for sensitive systems. They should also apply risk checks when a session moves between applications or enters an administrative interface.

Credential rotation must include related systems and vendors. Rotating one exposed secret leaves little value if similar credentials or naming patterns remain active elsewhere.

Supply-chain agreements should define security logging, breach notification, privileged access, and identity controls. Vendors need enough telemetry to reconstruct agent-driven campaigns that shift quickly between targets.

Nuclear regulators and energy companies face an additional segmentation requirement. Business networks, regulatory portals, and operational technology must have independently enforced boundaries.

The reported campaign does not show those operational boundaries failing. It does show why organizations cannot assume that an administrative compromise will remain isolated.

Defensive AI can help analyze logs and correlate activity across systems. However, adding another agent does not automatically correct missing authentication or excessive trust.

The strongest controls operate before model judgment becomes necessary. They include deny-by-default permissions, protected secrets, hardened APIs, network isolation, and short-lived credentials.

Teams should also rehearse incidents involving high-speed parallel activity. A response plan designed around one compromised workstation may not fit simultaneous attacks across agencies and suppliers.

Google News coverage may frame this as the arrival of autonomous hacking. Security leaders should translate that headline into a more practical instruction.

Every exposed weakness now has a shorter grace period. Fixing known identity and application failures matters more when software can find and combine them continuously.

Three Signals to Watch After the Google News Headlines

The next evidence should clarify the incident’s impact, the agents’ actual independence, and whether defenders change their controls.

The first signal is an official technical account from Taiwan. Its government has not publicly supplied the detailed system logs needed to verify Dream’s reconstruction.

A useful disclosure would identify which agencies experienced confirmed access, which systems lost data, and whether the nuclear regulator contained the activity at its administrative perimeter.

It should also clarify whether July’s reported government attacks belong to one campaign or several unrelated operations. Similar timing and tools do not prove common control.

If Taiwan confirms the 21-system mapping and 85 compromised accounts, confidence in the reported scale will increase. A narrower finding would weaken the broadest interpretations.

The second signal is publication of additional technical indicators. File hashes, infrastructure details, request patterns, and selected agent logs would help independent researchers test the report’s conclusions.

Those artifacts could reveal where humans intervened. They might show whether agents initiated exploitation themselves or followed detailed operator commands.

They could also identify the model behind Hermes and OpenClaw. That information would help vendors evaluate which safeguards failed and whether local modifications bypassed them.

More evidence would not need to expose victim systems. Researchers can redact sensitive targets while preserving timelines, decision traces, and behavioral indicators.

The third signal is a defensive response across identity and critical infrastructure systems. Watch for mandatory multifactor authentication, API audits, debug-endpoint reviews, and tighter SSO boundaries.

Taiwan has already emphasized cybersecurity oversight for nuclear facilities and critical digital assets. The question is whether this campaign changes requirements for connected administrative and supplier networks.

Regulators elsewhere should pay attention. The United States Nuclear Regulatory Commission is already studying AI’s uses and risks within nuclear applications through its AI readiness program.

That work traditionally focuses on how operators and regulators use AI safely. The Taiwan report adds a separate concern: hostile agents targeting the digital systems surrounding nuclear oversight.

A meaningful response would treat agent activity as a distinct operational pattern. Defenders need detections for parallel reconnaissance, repeated authentication testing, and machine-speed switching between unrelated services.

They also need governance for their own agents. A defensive system with broad credentials and unrestricted tools can become another source of risk if compromised.

The larger trend will become clearer if similar campaigns appear. One reconstructed archive shows feasibility, but repeated incidents would demonstrate a durable change in attacker behavior.

Security teams should therefore track more than dramatic breach counts. They should look for reduced time between reconnaissance and exploitation, wider parallel targeting, and automated validation of attack paths.

The Taiwan case carries a simple warning even if later evidence narrows some claims. Existing security debt becomes easier to exploit when attackers can assign it to persistent software workers.

For developers, that means treating authentication and authorization as testable product requirements. For enterprise buyers, it means asking vendors how they isolate agents, record actions, and limit credentials.

For knowledge workers, the lesson is less technical but equally important. Sensitive information can help attackers understand relationships and workflows even when it lacks passwords or source code.

The central question after these Google News headlines is not whether AI can replace every hacker. It is whether defenders can adapt before one operator controls the workload of many.

Audit internet-facing systems, remove dormant interfaces, review SSO trust, and verify supplier access now. The reported campaign shows how quickly separate weaknesses can become one attack path.