“First of its Kind” Autonomous AI Cyber Attack on Taiwan Signals Big Changes to Threat Landscape

News has recently broken that in early July, hackers suspected to be based in China executed what is thought to be the world’s first successful autonomous AI cyber attack on the government of Taiwan. It involved the cracking of nearly 100 user accounts and exfiltration of thousands of internal documents, all handled without human intervention. The attack is new and novel not just due to being totally automated by commonly used AI agents, but also in its incorporation of “learning cycles” and changes to approach in response to newly encountered defensive measures.

These autonomous AI agents are still not going rogue and thinking for themselves, nor are they showing any highly advanced technique beyond fairly basic human capability. However, they are proving effective and reshaping the threat landscape due to pure speed in trying all available possibilities combined with the ability to learn and document from prior encounters and failures. The incident also demonstrates that AI developer safety guardrails cannot be sufficiently relied upon for safety.

AI-managed cyber attack ran relentlessly from July 1 to July 4

The autonomous AI agents worked away doggedly for a few days at the beginning of July, noisy and crude at times but continuing without a break and at a speed no team of humans could ever match. They alternated between attack attempts and “learning cycles” in which they reviewed prior attempts and sought new solutions from forums, public code and vulnerability disclosures.

Even though this appears to be state-backed Chinese hackers moving against one of their usual government targets, the methods they used are currently available to anyone. The big takeaway for the average organization is thus that this approach can be used against you by a sufficiently motivated attacker, and the time to be ready for it is right now.

So what exactly is autonomous AI able to do? The cyber attack in this case leveraged Hermes and OpenClaw to create a team of eight agents with an automated system directing their actions. The team first performed recon, mapping out the whole of Taiwan’s government cyber ecosystem within the space of a day. This also led to the discovery of numerous unauthenticated API endpoints, at least one of which exposed an open system with thousands of employee personnel records.

This gave the autonomous AI agents known usernames to try. The next move in the cyber attack was a simple password spraying campaign against these accounts. The AI stuck to predictable passwords in these attempts, beating all CAPTCHA checks along the way by using Tesseract OCR. This yielded a total of 85 cracked accounts that were used for further lateral movement, including into third-party government contractor systems.

Is the age of mandatory autonomous AI defense here?

There are some important takeaways about capability. The first is that the attackers seem to have trivially slipped the agent safety guardrails by pretending all of this was done as “authorized penetration testing.” That points to AI model guardrails being generally inadequate to prevent their deployment in cyber attacks.

And while AI tools are not “superhackers” in the sense of intelligence or sophistication, they shorten what would take days or weeks of work for a basically competent human team into mere minutes. That means greatly reduced barriers of entry for cyber attacks in terms of not just time, but cost.

The upshot is that the cyber attack wholly relied on exposed APIs, known vulnerabilities and weak passwords to be successful. All of these are easily fixable elements, and AI can help with rapid discovery.