China-Linked Hackers Used AI To Run First-Ever 'Autonomous' Cyberattack On Taiwan

Israeli cybersecurity researchers allege that Chinese-linked hackers employed open-source artificial intelligence agents to carry out an unprecedented autonomous cyber assault on Taiwan's government. According to the Financial Times, the attack breached over 85 accounts and led to the theft of more than 2,500 employee records. The campaign, which lasted four days in early July, utilized up to eight autonomous agents simultaneously.

The malicious actors mapped 21 government systems before infiltrating user accounts and extracting sensitive information. The attack then expanded to include Taiwan's nuclear safety agency, seven energy firms, suppliers, and additional government entities. The evidence was discovered within a 160-megabyte online archive obtained by Dream during their ongoing investigation of cyber threat actors.

The attackers constructed their tool using two freely available open-source AI agent systems - Hermes and OpenClaw - which can autonomously carry out multi-step tasks utilizing large language models. The researchers were unable to ascertain which foundational model powered the agents, but the evidence revealed that the AI's safeguards were bypassed by posing the intrusion as an authorized penetration test.

This malicious toolkit devised attacks on its own, continuously evaluating available evidence, ranking potential attack paths, and reprioritizing them as conditions evolved. When one method failed, the tool would assign another agent to search the internet for relevant information and generate an alternative strategy.