'Near-autonomous' AI agents attack Taiwan's nuclear safety agency
- ID
- 13689
- Status
- summarized
- Published
- 13 Aug 2026, 5:45 AM
- Fetched
- 13 Aug 2026, 6:05 AM
- Provider
- The Register
- Category
- technology
- Original URL
- https://www.theregister.com/security/2026/08/12/near-autonomous-ai-agents-attack-taiwans-nuclear-safety-agency/5287055
- Source URL
- https://www.theregister.com/headlines.atom
Summary
- Score
- 7.5
- Created
- 13 Aug 2026, 6:05 AM
- Tags
- Audience
- developersai_agent_usersai_ml_learnerssaas_startup_founders
What happened
Suspected Chinese-language operators used open source AI agents (Hermes and OpenClaw) to launch a 'near-autonomous' attack on Taiwanese government systems over July 1-4, compromising 85 accounts and extracting 2,500+ personnel records. The agents deployed up to 8 sub-agents across 12 attack waves, mapping 36+ API endpoints from a single portal, finding unauthenticated user databases, solving CAPTCHAs with 100% accuracy, and discovering hidden API endpoints that returned valid authenticated sessions without credentials.
Why it matters
This is a documented real-world offensive deployment of AI agents showing exactly what automated attack surface discovery looks like — if you ship government or enterprise APIs with unauthenticated endpoints, predictable passwords, or hidden routes that accept arbitrary request bodies, AI agents will find and exploit them faster than human attackers. Builders in Malaysia and Southeast Asia should treat this as a concrete prompt to audit API authentication coverage, especially on systems exposed via government portals or SSO integrations.
Discussion angle
The attack used off-the-shelf open source agents (Hermes, OpenClaw) — discuss what this means for defenders: the barrier to automated offensive security testing is now near-zero, so what API security baseline should every team assume an AI agent will probe within hours?