China-linked hackers reportedly used AI agents to breach Taiwan government systems
Taiwan's government detected AI-assisted cyberattacks in July 2026 that compromised at least 85 government accounts and extracted over 2,500 personnel records. An Israeli cybersecurity firm that detected the intrusion reported the attackers used open-source AI agents to conduct the attack, and researchers identified linguistic evidence suggesting China-linked actors, though Taiwan's government did not formally attribute the attack.
What happened
Taiwan's Ministry of Digital Affairs detected abnormal AI-assisted cyberattacks on government agencies beginning July 20, 2026. The attacks came from overseas and combined manual operations with AI agent-assisted attacks using open-source tools such as Open Claw.
Israeli cybersecurity company Dream reported that AI agents working together extracted credentials and personnel records from Taiwan's justice ministry, compromised at least 85 government user accounts with over 2,500 personnel records extracted, and scanned Taiwan's nuclear safety agency for vulnerabilities.
Reported impact
The compromised government agencies included at least 85 user accounts across Taiwan's government. The attackers extracted more than 2,500 personnel records and expanded the attack to Taiwan's nuclear safety agency and at least seven energy companies.
Taiwan's Ministry of Digital Affairs stated that affected units have completed their handling of the incident. The government established protective guidelines and strengthened system monitoring to block attacks early in response.
Index analysis
Dream described the campaign as a first-of-a-kind breach, noting the attackers used open-source AI agents to build an autonomous hacking tool that behaved like a coordinated cyber team.
The investigation showed clear characteristics of an overseas source, with a hybrid approach combining manual operations and AI agent-assisted attacks. Dream noted that the use of Simplified Chinese in internal communications linked to the hack indicated a high probability the operator was connected to China, according to reporting by the Financial Times.
Governance controls
Taiwan's National Institute of Cyber Security issued a series of warning alerts during the investigation into the attacks.
In response to the AI-derived cybersecurity threat, the government established protective guidelines and strengthened system monitoring across agencies to block attacks early.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.