Taiwan confirms first-of-its-kind AI-assisted cyberattack targeting government agencies and critical infrastructure

4. Sec

Taiwan's Ministry of Digital Affairs has confirmed that the island sustained a sophisticated, AI-assisted cyberattack targeting multiple government bodies. The incident, detected in late July, marks one of the first known instances of a coordinated, near-autonomous hacking operation directed against state infrastructure using mainstream AI frameworks.

According to security alerts issued by Taiwan's National Institute for Cyber Security, the intrusion involved a hybrid approach that combined human steering with autonomous AI agent frameworks, including OpenClaw.

Rapid Exploitation Across 21 Connected Systems

The breach was initially detected by Israeli cybersecurity firm Dream, which reconstructed the operation after discovering the attackers' operational logs. Over four days, autonomous AI agents mapped 21 connected Taiwanese government systems, cracked 85 user accounts, and exfiltrated over 2,500 personnel records.

The operation quickly expanded beyond its initial access points, probing the Ministry of Justice, the Atomic Energy Council’s nuclear safety agency, government IT supply chain vendors, and several state-linked energy companies.

State Attribution

While Taiwan’s Ministry of Digital Affairs refrained from formally naming a specific country, cybersecurity researchers noted that internal communications and system logs recovered from the attack framework were written in simplified Chinese, pointing toward China-linked threat actors.

The operation fits into a broader pattern of hybrid warfare targeting Taiwan, where Chinese cyberattacks on critical infrastructure averaged 2.63 million attempts per day in 2025. Cybersecurity analysts emphasize that while the attack demonstrated high operational velocity, it relied on a "human-in-the-loop" model.

Operators established mission directives, circumvented safety guardrails, and provided high-level objectives, allowing the AI agents to execute complex, multi-system lateral movements at machine speed.

Defensive Upgrades and Global Warning

Taiwanese authorities confirmed that the affected agencies successfully contained the breach, updated internal access protocols, and established new defensive guidelines to counter AI-driven threat vectors. The incident highlights a fundamental evolution in global cyber warfare: as frontier AI models become accessible to malicious actors, state-backed hackers can scale multi-vector intrusions, automate credential harvesting, and bypass standard security perimeters with unprecedented speed.