Israeli cybersecurity firm Dream documented what looks like the first fully autonomous, end-to-end AI hacking operation against a government target. Over four days at the start of July, according to the Financial Times, suspected Chinese hackers ran a tool built entirely from publicly available AI agents that mapped 21 government systems, hunted for vulnerabilities, and switched tactics on its own whenever it hit a wall.
“Suspected Chinese hackers used publicly available AI tools to compromise government websites in Taiwan in a first-of-a-kind breach, highlighting how artificial intelligence is transforming cyber warfare.” reported the Financial Times.
The tool wasn’t a single script running one attack. It deployed up to eight autonomous agents simultaneously, each working a different angle, more like a coordinated hacking team than a piece of malware. By the time researchers found it, the operation had compromised at least 85 government accounts, pulled over 2,500 personnel records, and expanded to hit a nuclear safety agency and at least seven energy companies.
Dream’s chief strategy officer, Amir Becker, spent years running cyber operations for Israel’s Unit 8200 before this, and he’s not easily rattled by new attack tooling. He said flatly he’d never seen anything like this level of autonomy directed at a government before. “This must be the basic assumption of every government around the globe,” Becker said.
He argued that permanent, assumed compromise is now the only realistic starting posture.
Dream won’t officially name the target government, citing company policy, though a person familiar with the matter told the FT it was Taiwan. The clues inside the data point the same direction: internal communications tied to the hacking tool were written in Simplified Chinese, while the data actually stolen from the target came back in Traditional Chinese, the script used almost exclusively by government systems in Taiwan, Hong Kong, and Macau. Taiwan’s Ministry of Digital Affairs declined to confirm anything specific, saying only that incidents involving government agencies follow established response procedures.
What makes this different from an AI model going rogue during a lab test, something Anthropic, OpenAI, and Meta have all separately reported in recent weeks, is that this wasn’t an accident inside a sandbox. Researchers found the toolkit sitting in a 160MB archive, 1,395 files built around two open-source AI agent frameworks, Hermes and OpenClaw, both freely downloadable and designed to let AI models act autonomously on real tasks. Whoever built this deliberately assembled it as a weapon.
Getting the underlying AI model to cooperate took a specific trick rather than brute force. The operators had bypassed the model’s safety guardrails simply by framing the entire hacking campaign as an authorized penetration test, a scenario the model apparently had no reliable way to verify or reject. That’s a strange kind of vulnerability: not a flaw in the code, but a flaw in how convincingly you can lie to a system that’s trying to be helpful.
The part Dream’s researchers found most striking wasn’t the scale, it was the decision-making. The tool kept ranking and reprioritizing possible attack paths as new evidence came in, and when one route hit a dead end, it spun up another agent to search the internet for fresh information and try a different approach, the same iterative process a human red-teamer would run, just without anyone sleeping.
“The most striking feature of the July attack was how the tool continuously ranked and reprioritised possible attack paths based on available evidence, Dream said.” reported the FT. “When one attack path failed, the tool deployed another agent to scour the internet for information and devise a new approach as a human hacker would.”
Taiwan’s National Security Bureau already logged an average of 2.6 million Chinese cyberattacks a day in 2025, up 6% year over year; if a meaningful fraction of that volume starts running with this kind of autonomy, the math on defending against it gets a lot uglier very quickly.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, AI Agents)