Taiwan government agencies were hit by AI-assisted cyberattacks originating from foreign sources in July 2026, the Digital Development Ministry confirmed on August 13 [1, 2, 3, 4]. The attacks combined human hackers with AI agents like OpenClaw and Hermes in a hybrid offense mode, deploying up to eight AI programs simultaneously over four days in early July to scan 21 government systems for vulnerabilities [2, 3, 4, 5].

At least 85 government user accounts were compromised, resulting in theft of over 2,500 personnel records [2, 3, 4, 5]. The attack scope expanded beyond core agencies to include Taiwan's Nuclear Safety Commission and seven energy companies [2, 3, 5]. The attackers exploited backup and testing systems as entry points instead of main servers [3, 6].

Taiwan's cybersecurity monitoring units first detected abnormal activity in July, issuing initial alerts from July 20 while investigations confirmed the attacks originated abroad [1, 2, 3, 4]. Internal communications found were in simplified Chinese, while stolen data was in traditional Chinese, strongly indicating likely Chinese-linked operators, though Taiwanese officials did not explicitly name any country as responsible [3, 4, 5, 7, 8, 6]. The Israeli cybersecurity company Dream described the attacks as a near "end-to-end autonomous" AI-driven operation, a new cyberattack form against government targets [2, 3]. Amir Becker, Dream's strategy chief, said, "Governments must assume they are under continuous cyberattack" [3].

Experts noted that despite heavy AI involvement, significant human control guided the operations. Semgrep security researcher Cris Thomas stated, "AI-assisted hackers can achieve objectives quickly, but powerful human operators still direct the attacks" [9].

Taiwan’s Digital Development Ministry said investigations and remediations have been completed, and continuous monitoring is taking place to detect other potential attack vectors [1, 2, 3]. The National Security Bureau reported that cyberattacks from China increased 6% in 2025, averaging 2.63 million attacks daily on Taiwan's critical infrastructure, some linked to hybrid military exercises [1].

Taiwan's Nuclear Safety Commission confirmed heightened cybersecurity measures including firewalls, intrusion prevention systems, application firewalls, and a security operations center to defend against continuing threats [10]. The government will continue to strengthen defenses and vigilance against further attacks.