Hackers Used Autonomous AI Agents in a Four-Day Cyberattack on Taiwan

Attackers used autonomous AI agents to carry out a four-day intrusion campaign against government entities in Asia, with Taiwan identified as the primary target — operations extended to the country's nuclear safety regulator and major energy companies, marking one of the clearest documented cases yet of AI agents actively conducting, not just assisting, a real cyberattack.

How Autonomous the Attack Actually Was

In a related, separately documented case from the same period, a Chinese-speaking attacker operated DeepSeek through the open-source "Hermes Agent" framework to run attacks with minimal human involvement: after an initial instruction delivered once via Telegram, the agent itself explored internet-facing systems, selected exploits from public sources, and executed them — with no additional operator input confirmed during the session.

Why This Matters Beyond One Incident

• Security researchers now describe AI as an active, autonomous partner in the attack cycle of state-sponsored threat actors from China, Russia, North Korea, and Iran — not an isolated tool used occasionally
• Autonomous AI systems have also been used to exploit software supply chains and consumer technologies through 2026, extending well beyond the nation-state targets in this specific incident
• For critical infrastructure operators specifically — energy, regulators, utilities — the practical takeaway is that attack campaigns can now sustain multi-day autonomous operation with minimal attacker oversight, changing the detection and response math