Taipei: Overseas hackers used artificial intelligence agents to target Taiwan government agencies in a July cyberattack, the Ministry of Digital Affairs (MODA) said Thursday, following a Financial Times report on the incident.
According to Focus Taiwan, MODA's Administration for Cyber Security stated that its cybersecurity monitoring unit detected the attacks in July and that the National Institute for Cyber Security began issuing alerts on July 20. An investigation was launched immediately, and the source, methods, and scope of the attacks have been determined, while affected agencies have completed their responses. However, the ministry did not disclose where the attacks originated.
The FT report published Wednesday revealed that researchers at Israeli AI company Dream were the first to detect the intrusion. The attackers allegedly used open-source AI agents to build an autonomous hacking tool. The report also cited a source familiar with the matter as saying that Taiwan was the target.
The tool compromised at least 85 government user accounts and extracted more than 2,500 personnel records before the attackers expanded their operations to Taiwan's nuclear safety agency and at least seven energy companies, as reported by the U.K.-based news outlet. Dream did not attribute the attack to a specific group, but researchers noted that internal communications linked to the operation were in simplified Chinese, suggesting the operators were likely connected to China.
Meanwhile, the administration indicated that the attacks showed clear signs of originating overseas and involved a hybrid approach combining conventional hacking with AI agents such as OpenClaw. AI agents can rapidly combine multiple attack techniques and use secondary systems, such as backup and testing systems, as stepping stones, making attacks faster, cheaper, and more scalable, it explained.
MODA stated that the government has established guidelines to address emerging AI-related cybersecurity threats and will continue to strengthen its overall defenses and monitoring for potential attack paths.