Taiwan named as the target of July's agent-swarm intrusion: 85 accounts, 2,500+ records, a nuclear agency scanned

On 12 August 2026 the Israeli cybersecurity firm Dream published research on a four-day intrusion into an unnamed Asian government by a multi-agent AI framework, and the Financial Times, which was briefed first, identified the target as Taiwan. The Register reported the same day that a person familiar with the attack confirmed it. Dream dates the campaign to 1–4 July 2026 and describes 12 attack waves in which up to eight sub-agents ran in parallel: they mapped 21 connected government systems, cracked 85 government employee accounts — 84 of which authenticated onward to an internal system — and took at least 2,564 personnel records, including 239 legal professionals reached through an unauthenticated Ministry of Justice endpoint. Taiwan's Ministry of Digital Affairs confirmed on 13 August that government agencies had been attacked from an overseas source, without naming a country. Dream's report is the primary account, and the entry behind this date — alongside the earlier July entry it points to — sits in the AI incident archive, where every record carries its own sources, severity, confidence and disputed flag.

What Dream says the framework did

Dream's evidence is not a victim's incident report. It is the attacker's own operational workspace: a 160 MB archive of 1,395 files, recovered intact, containing the agents' plans, triage scores, after-action reports and tool output. The write-up, titled Inside a Multi-Agent AI Framework Used to Compromise Government Entities in Asia, says the framework ran on two open-source agent stacks, Hermes and OpenClaw, with workspaces identified as .hermes and .openclaw.

Reconnaissance began from a single Angular government portal. The agents downloaded and decompiled its JavaScript bundles and pulled out every embedded URL, API endpoint, OAuth client ID and Keycloak configuration object they contained — enough to enumerate 21 connected government systems, six SSO sub-realms, the OIDC endpoints, two RSA signing keys and every supported authentication flow. On one target alone they found 36+ API endpoints spanning account management, user retrieval, file upload and administration, many with no authentication at all; one system, in Dream's words, "exposed its entire user database without any authentication — thousands of employee records including names, departments, and SSO account IDs."

The framework then did something Dream presents as an autonomous decision: it followed a URL in the bundle to a GitBook documentation portal hosting the national SSO integration guide, used GitBook's llms.txt index and the .md suffix to scrape raw page text, and downloaded two SDK sample projects, in Java Spring Boot and ASP.NET Core 8.0. It ran its own static analysis over them and logged an open redirect and an unauthenticated code-to-token exchange. Dream is explicit that none of that mattered: cross-referencing the framework's findings against its final validated list shows zero overlap, and the actual breaches came from server-side flaws a standard black-box test would have found anyway.

Initial access came from three routes running in parallel. Three hidden endpoints on a government web application accepted any request body and returned a valid authenticated session with no credentials — developer debug endpoints left exposed in production. A government API accepted JWT tokens with the algorithm field set to none, so a valid identity token could be forged without the signing key. And a credential spray against the department's office automation portal used Tesseract OCR to solve each CAPTCHA image at 100 percent accuracy, then tried password patterns built from each employee's ID: an initial 12 accounts cracked, then 73 more as further patterns were found, 85 in total.

Only 84 of the 85 ever mattered, because a single SSO bridge did the rest: each connected internal system exposed an entry point that automatically trusted the office automation session, with no additional authentication, MFA or user confirmation. 84 accounts, 98.8 percent, authenticated onward to the department's internal information system, reaching internal dashboards, equipment management interfaces and personnel statistics pages. The framework tested every credential against every connected system in parallel.

What left the network, per Dream: 2,564+ personnel records — 1,409 employees with name, department and SSO identifier, 916 users pulled from an unauthenticated API, and 239 legal professionals from an unauthenticated Ministry of Justice endpoint — plus a complete JSON export of the department's users, seven SSO client secrets, six internal database credentials across MSSQL, Oracle and Sybase, and internal network IP ranges. A web shell was uploaded through an unrestricted file-upload API and placed at a known path, but a second Forms Authentication layer stopped it executing; Dream calls that a partial success that fell short of remote code execution.

Two behaviours are the reason Dream treats this as a step change rather than a bigger scanner. The framework ran five recorded "learning cycles" that searched vulnerability databases, GitHub and published research for techniques specific to the target's product estate, and it scored work with a two-layer Bayesian model: individual findings started at a 0.50 prior and were promoted or discarded on explicit likelihood ratios, while attack chains were ranked by a success probability combining confirmed steps and blocker estimates. The final 12-wave summary lists 8 confirmed vulnerabilities and 7 false positives the framework caught and excluded itself, including a blind SQL injection that turned out to be an SMTP timeout. Dream also records that the framework's own model refusals were bypassed by framing the whole operation as authorised penetration testing.

The nuclear safety agency was scanned, not breached

The headline on The Register's 12 August story reads "Near-autonomous AI agents attack Taiwan's nuclear safety agency." The body of the same story, and Dream's own write-up, say something narrower. After the initial foothold, Dream writes, the operation "expanded to government IT supply chain vendors, a nuclear safety agency, a government email system, and 7+ energy sector companies — scanning them all in parallel for misconfigurations, exposed admin interfaces, and exploitable vulnerabilities." Reuters, carrying Taiwan's response, described the same scope as agents that "steal personnel records from Taiwan's justice ministry, and scan its nuclear safety agency for vulnerabilities".

So the nuclear safety agency appears in the record as part of the reconnaissance set, not as a confirmed compromise. No document reviewed for this piece — Dream's report, The Register's account, or Taiwan's statement — records an intrusion into it, data taken from it, or any effect on nuclear safety operations. The same holds for the government email system, the 7+ energy companies and the supply-chain vendors: the record places them in a parallel scan, and stops there. Scanning a regulator's perimeter is itself an event worth recording. It is not the same event as breaching one, and the distinction is the difference between a headline and the evidence.

How Taiwan described it

Taiwan's Ministry of Digital Affairs (MODA) issued its account on Thursday 13 August, a day after the research went public. Its cybersecurity monitoring units, it said, detected an "abnormal attack" on government agencies in July, and from 20 July its National Institute of Cyber Security issued a series of warning alerts while investigating. The investigation found "clear characteristics of an overseas source", with a hybrid of manual operations and AI-agent-assisted attacks "such as Open Claw". MODA said the sources, methods and scope of impact had all been fully investigated, that affected units had completed their handling, and that the government had issued protective guidelines for AI-related cybersecurity threats and strengthened monitoring across agencies. It declined to say where the attack originated.

MODA's statement is narrower than Dream's in one direction and wider in another. It confirms the victim and the AI-assisted character of the attack, but it does not repeat Dream's counts — the 85 accounts, the 2,564 records and the 21 systems appear in Dream's report and in the Financial Times's account of it, not in the ministry's own words. And it dates detection to July, with national alerts from 20 July, weeks before either the research or the press coverage. Whatever "near-autonomous" means here, it does not mean the campaign ran undetected to the end.

The Financial Times has not been read for this piece: it is paywalled, and its reporting is known here through The Register, CyberScoop and Reuters, all of which cite it as the outlet first briefed on Dream's findings. Reuters adds that Dream declined to share its data or name the government when approached.

What is established, and what is not

The archive grades this record confidence A — well documented, primary sources that agree — and does not mark it disputed. What that grade covers, and what no source in the record settles, are different lists:

• Established: the campaign ran across four days in early July 2026 in 12 waves on Hermes and OpenClaw; 21 government systems were mapped; 85 employee accounts were cracked and 84 authenticated onward; at least 2,564 personnel records were taken, alongside SSO client secrets, database credentials and network ranges. These come from Dream's report, the recovery of whose 1,395-file workspace is the basis for all of it.

• Established: Taiwan was the target. The Financial Times identified it, The Register's source confirmed it, and MODA confirmed on 13 August that government agencies were attacked from overseas with AI-agent assistance.

• Established: the set of organisations Dream says were scanned in parallel, and that remediation was reported as complete by the affected units in Taiwan.

• Not established: who did it. Dream says the operational documentation "points to a Chinese-language operator" and notes code-switching between Simplified Chinese in internal status reports and Traditional Chinese in target-facing analysis. Dream did not attribute the campaign to the Chinese government or to any named group, and MODA did not name a country of origin. The attribution to "suspected Chinese cyber operatives" in some coverage is an inference from the operator's language, not a finding any government has published.

• Not established: whether the nuclear safety agency, the energy companies, the email system or the supply-chain vendors were actually compromised, what was taken from them if anything, and what became of the 2,564 personnel records after exfiltration. Nobody named in the record has published victim identities, and no source reviewed here documents operational damage.

• Contested in framing, not in fact: "near-autonomous". Cris Thomas, a security researcher at Semgrep, told Reuters the campaign was "not totally 100 per cent autonomous. There was a capable operator in charge". Dream's own conclusion points the same way, saying a framework that works at this level "demands careful adjustment to the specific task, optimization of agent coordination, and fine-tuning of decision logic" — sophistication in the harness and the tuning, not in the model alone. The record's facts are not in dispute; the word chosen for them is.

One small documentary oddity is worth recording, because it does not resolve cleanly. Dream's post, as read on 29 October 2026, carries a machine-readable publication date of 24 September 2026 and a modification date the same day, and the page contains no mention of Taiwan at all. The 12 August date comes from The Register and CyberScoop, both of which reported the research as published on Wednesday 12 August 2026 — the date this entry carries. Whether the page was moved, reissued or re-dated in Webflow is not something the page itself says.

What changed after the disclosure

Dream says it followed responsible disclosure: it notified the organisations it had found before publication, gave them time to remediate, and avoids identifying either the targets or the operator behind the framework. Taiwan's account is consistent with that sequence at the government end. Detection came in July, national alerts from 20 July, an investigation that MODA says covered sources, methods and scope, handling completed by the affected units, and new protective guidelines plus strengthened monitoring across agencies. The seven SSO client secrets in Dream's list are described as rotated, though the naming conventions that generated them had already been exposed.

Nothing in the coverage reviewed for this piece records an arrest, a takedown, a sanctions action or a formal attribution by any government. The framework's components — Hermes and OpenClaw, both open source and freely obtained — remain available, which is the point commenters such as SC World have drawn from it: the attack was assembled from two downloads that no procurement process vets.

The record

The entry this article is built from is dated 12 August 2026, a single day, with no end date. That is the day the naming became public: the research, the Financial Times's identification and The Register's confirmation. The intrusion it describes is dated to 1–4 July 2026, and the record says so by pointing to an earlier July entry for the fuller story. Its fields are: kind incident, a realised AI-related incident; severity low; confidence A; disputed false; real harm true; AI involvement confirmed; region Taiwan; type tag WEAPON; landmark false.

Those fields sit beside each other without contradiction. What was harmed, on the record's own evidence, is data — personnel records, credentials and network detail, taken from government systems and an unauthenticated ministry endpoint. What was not harmed, on the same evidence, is anything that has been shown to touch nuclear or energy operations. The archive grades the severity low and records real harm as true; the two describe different questions, and both belong in the entry.