AI Agents Automated Intrusions Against Taiwan Government and Critical Sectors

Security researchers reported that suspected China-linked operators used open-source AI agent frameworks and multiple large language models to automate cyber intrusions against internet-exposed targets in Taiwan and elsewhere in Asia. Palo Alto Networks Unit 42 said a Chinese-speaking actor tracked as "knaithe" and "KnYuan" used Hermes Agent connected to a DeepSeek model to perform reconnaissance, vulnerability research, and parts of exploitation, while also falling back to manual exploitation when autonomous attempts failed. The actor also tested other Chinese and Western models, including Qwen, GLM, Kimi, MiniMax, Claude Code, and OpenAI Codex, indicating active evaluation of AI tooling for offensive operations.

Dream said a related campaign in early July used a platform built from the open-source Hermes and OpenClaw frameworks to carry out what it described as the first observed end-to-end autonomous cyberattack on a government target in Taiwan. According to the firm, the operation ran for four days, deployed up to eight agents in parallel, mapped 21 government systems, compromised at least 85 user accounts, and stole more than 2,500 personnel records before expanding to Taiwan’s nuclear safety agency, at least seven energy companies, government suppliers, and other government systems. Researchers said the activity showed AI agents can continuously adapt attack paths in real time and materially increase the speed and scale of intrusion activity, even without custom malware or highly specialized operators.